Execution Permissions Changed Mid-Session in a Stalled Codex Run

During an ongoing task run by Codex, execution stalled after generating explanations and preparation steps.
Follow-up instructions still received responses, but tasks requiring external network connections did not proceed.

Reviewing the session history on Mac showed that execution permissions had changed mid-conversation.
Network access was functional earlier in the run, but switched to restricted mode upon resuming.
With specific instructions and endpoints omitted, this note records permission transitions, error logs, and recovery steps.

Responses Arrived but Work Stalled

The session was used between October 4 and 7, 2026.

In this conversation, local preparation proceeded normally, but actions were rejected once external services were called, ending responses with operations left unfinished.

MCP (Model Context Protocol) is a mechanism for Codex to call external tools and services.
Around the time execution halted, tool calls over MCP recorded the following error:

MCP tool call requires approval, but approval policy is never

External connection commands also logged Operation not permitted.
The network attempt itself was blocked by the Codex sandbox rather than rejected by target authentication.

A task_complete entry appeared immediately after a message stating that tasks remained incomplete.
The response ended before the assigned task was finished. Actual tool execution logs confirmed the incomplete operations.

Network Permissions Changed Mid-Conversation

The session history retained turn_context records, which log runtime parameters for each turn (from receiving user input to completing a response).
This context preserves the active model, approval policy, and execution constraints at each point.

Comparing the records through October 5, the resumption on October 7, and the handed-off new conversation produced the following comparison:

Stage	sandbox_policy.type	Command Network Access
Original session, October 5	danger-full-access	Enabled
Original session, October 7 resumption	workspace-write	Restricted
Handoff session, October 7	danger-full-access	Enabled

approval_policy remained set to never (do not ask for user confirmation) across all stages.

danger-full-access lifts local sandbox isolation, while workspace-write grants write access to working directories.
According to OpenAI’s approvals and security documentation, default workspace-write disables network access unless explicitly enabled in configuration.

The log at resumption explicitly stated network_access: false.
The permission profile was marked restricted; runtime constraints had switched during the conversation.

What approval_policy: never Actually Governs

approval_policy: never remained constant throughout all stages.
The setting does not mean all actions execute unconditionally; instead, it determines whether Codex prompts the user for confirmation during execution.

OpenAI’s approvals and security documentation notes that never pairs with each sandbox mode.
Suppressing confirmation prompts does not lift configured execution limits.

When execution halted on Mac, the tool required approval while the runtime policy suppressed approval prompts, rejecting the call without prompting.
Further instructions in the conversation to continue hit the same error on subsequent tool invocations.

OpenAI’s permissions documentation separates local command permissions from MCP and connector controls.
Because model communication runs through a separate channel from command execution, model responses arrived as expected even while command network access remained blocked.

Connection Drops in Logs

A separate recent session also logged broken connections during model response streaming.
In WebSocket communications, the connection closed prior to response.completed.

websocket closed by server before response.completed

Another disconnection recorded reaching the 60-minute connection ceiling.
OpenAI’s WebSocket Mode guide notes that Responses API connections have a 60-minute limit, after which clients must reconnect.

Handoff to a New Conversation and Remaining Work

On October 7, uncompleted operations and final errors were organized to transfer the task into a new conversation.
In the destination conversation, network access was active, allowing external operations that stalled earlier to proceed.
Both tool execution results and the final output confirmed completion of the remaining work.

The active model was gpt-6.1-sol (reasoning setting xhigh) in both the original session and the handoff session.
CLI versions recorded at session creation were 0.160.0 for the original session and 0.160.1 for the handoff session.

For similar stalls, preserving runtime context (turn_context) alongside conversation logs and tool errors clarifies where execution constraints diverged.
OpenAI’s troubleshooting documentation references ~/.codex/sessions as the standard storage path for session history.