How to Make Codex Ask Before Making Changes: Plan Mode and Permissions

Have you ever asked Codex to fix something, only to find that files were edited before you had a chance to review the approach? The clearest and most reliable answer is to start the task in Plan mode.

Plan mode lets Codex investigate the repository and present an implementation plan before you move to execution. This separates “deciding what to change” from “making the change.” The permissions option called Ask for approval is also useful, but it does not require confirmation before every edit inside the workspace.

Based on OpenAI's official documentation available on July 22, 2026, this guide explains how to review changes in advance in the Codex desktop app and how Plan mode, Ask for approval, and read-only access differ.

Use Plan Mode When You Want to Review Changes First

OpenAI's official best-practices guide recommends planning before coding when a task is complex, ambiguous, or difficult to describe. In the Codex app, you can enter /plan in the composer or press Shift+Tab to switch to Plan mode.

Use this workflow:

1. Switch to Plan mode before sending the implementation request.
2. State the goal, relevant files, constraints, and completion criteria.
3. Ask Codex to inspect the repository and propose a change plan.
4. Review the plan and request corrections to its scope or approach.
5. Explicitly request implementation only after you are satisfied.

For example, instead of immediately asking Codex to add dark mode to a settings page, ask it to identify the affected files, state-storage approach, design impact, and test strategy first. If the proposal is unsuitable, you can redirect the work before files are touched.

The /plan command is temporarily unavailable while Codex is already working. If you want a pre-change review, switch modes before submitting the new task.

Ask for Approval Does Not Pause Every Workspace Edit

Despite its name, Ask for approval is not a prompt that appears before every file edit.

Codex combines two safety layers: a sandbox that defines which resources it can access, and an approval policy that determines when it must pause before crossing that boundary. OpenAI's documentation explains that when normal workspace access is allowed, Codex can edit files and run commands within that workspace. Approval is generally requested when an action needs to write beyond the permitted area or use a restricted resource such as network access.

You should therefore not assume that selecting Ask for approval guarantees a preview before each edit. The setting helps protect the sandbox boundary, while Plan mode provides the separate workflow for reviewing an implementation approach in advance.

Separate Planning and Implementation into Two Stages

A practical workflow uses one turn for planning and another for implementation.

When Codex presents its plan, check at least the following:

• Whether the proposed files are limited to the necessary scope
• Whether compatibility with existing behavior and data formats is preserved
• Whether the plan includes unexpected deletion, migration, or dependency updates
• Which tests and checks will run after implementation

If the plan is acceptable, respond with an instruction such as: “Implement only this plan. If anything outside the plan becomes necessary, stop and ask me first.” This keeps the agreed scope visible if new information appears during implementation.

The main disadvantage is the extra review turn. For work involving multiple files, configuration changes, or deletion, that small delay is often outweighed by fewer unintended edits and less rework.

Add Read-Only Access When You Need a Stronger Boundary

If you want a technical barrier against writes as well as a planning workflow, select Read only when it is available in your environment. In the Codex app, use the permissions control beneath the composer to see which modes you can select.

A read-only permission lets Codex inspect a project but prevents it from creating, modifying, renaming, or deleting files covered by that policy. Planning under read-only access and switching to a write-capable permission only after approval provides a stronger boundary than a prompt alone.

Permission profiles are documented as a beta feature, and available modes can vary with app settings, local configuration, and organizational requirements. Some tool calls that need writes, network access, or app control may also fail in read-only mode. Make sure the selected permission still allows the investigation your task requires.

Treat a Confirmation Prompt as a Supporting Measure

For a small task, you can begin with an instruction like this:

First inspect the repository and present the target files, proposed changes, risks, and verification steps. Do not modify any files until I approve the plan.

This is convenient when you do not want to switch modes for every request. If you use the rule repeatedly, you can also record it in the repository's AGENTS.md.

However, a natural-language instruction is an operating rule, not a technical access boundary like a sandbox. For important repositories or tasks involving deletion, combine the instruction with Plan mode or read-only access.

Review the Diff After Implementation Too

An approved plan does not guarantee that every resulting edit matches it. Open Codex's change list or a Git diff and inspect the files changed, lines added or removed, and any unexpected generated artifacts.

Even when tests pass, the diff may contain an unnecessary configuration update, broad formatting, or a dependency change. Compare the result with the approved plan and request corrections before committing or publishing it.

Using Plan mode before implementation and reviewing the diff afterward makes the boundary between Codex's work and human judgment much clearer.

Summary

The clearest way to make Codex show its approach before changing files is to begin in Plan mode. Use /plan or Shift+Tab, review the target files, implementation approach, risks, and verification steps, and authorize implementation only when the plan is acceptable.

Ask for approval does not require confirmation before every edit inside an allowed workspace. When you need a stricter safeguard and the option is available, plan under read-only access and switch to a write-capable permission only after approval. Finally, inspect the actual diff to confirm that implementation matches the plan.

Safe Codex use is not only about reducing permissions—it is also about deliberately separating the stage where you decide from the stage where files change.