Find Codex agents and what they can reach, then check each tool call against the same policies you apply to your other coding agents.
Codex runs with your developers’ access to code, data, and production systems. Most of a session is routine, but a destructive command, a secret in context, or a read far outside the project can each be fully authorized by account permissions.
This brief shows how Obsidian keeps Codex inside your security policy. It inventories what Codex uses and can reach. A sidecar beside Codex then checks each tool call against your policy, with identity, HR, and data-label context, and allows or blocks it before it runs. Every decision is logged, under the same policies you set for Claude Code, Cowork, and Microsoft Copilot.
Read it to see how the decision flow works and four questions to ask any vendor about Codex security.