1 AI Catchup article about Least Privilege, newest first: 1 news story.
OpenAI shipped Codex permission profiles in beta -- reusable, inheritable policies that replace the coarse sandbox_mode/sandbox_workspace_write combo. A profile binds OS-enforced filesystem read/write/deny rules (down to **/*.env) to per-domain network and Unix-socket rules. Enterprise admins get fail-closed allowlists via requirements.toml. Profiles govern local sandboxed command execution only, not MCP servers, app connectors, browser, or cloud.
Tools, practices, and what matters, in your inbox every week.
