Treat a model switch as a permission transition
Use when: a Codex TUI session can switch models, especially before unattended security, repository, or infrastructure work. Model capability is no longer merely an inference choice: a cyber-specialty selection can change the thread's permission profile, approval policy, and reviewer.
default_permissions=":workspace",
approval_policy="on-request",
and
approvals_reviewer="auto_review"
in
trusted
configuration.
In
managed
requirements,
set
allowed_permission_profiles={":read-only"=true,":workspace"=true},
allowed_approval_policies=["on-request"],
and
allowed_approvals_reviewers=["auto_review"];
omit
:danger-full-access.
Start
a
new
thread
after
changing
policy.
At
every
later
model
switch,
capture
model
ID,
specialty,
effective
profile,
approval
policy,
and
reviewer
before
the
next
tool
call.
Acceptance
check:
in
a
disposable
repository,
start
a
clean
TUI
thread.
Record
the
permission
banner,
select
a
catalog
model
marked
cyber,
then
change
only
reasoning
effort.
Pass
if
state
remains
workspace-write,
on-request,
and
Auto-review;
the
notice
is
visible;
and
reasoning
changes
do
not
reset
the
profile.
Next,
edit
one
workspace
sentinel
and
request
one
write
to
a
disposable
path
outside
the
workspace.
The
first
should
run
inside
the
sandbox;
the
second
must
emit
an
Auto-review
request
and
decision
before
dispatch.
Fail
on
silent
full
access,
a
reviewer-free
escape,
or
any
unexplained
profile
change.
modelSpecialty,
applies
requirement-aware
cyber
defaults,
warns
on
Auto-review
and
full
access,
and
adds
tests
for
defaults,
fallbacks,
reasoning
preservation,
and
notices.
The
versioned
backport
changes
34
files,
including
309
added
TUI-test
lines.
Official
docs
define
Auto-review
as
a
reviewer
swap,
not
a
permission
grant.
Caveat:
the
backport
records
only
git-diff
validation,
not
published
test-run
output,
so
confidence
is
Likely
until
the
local
matrix
passes.
Auto-review
is
model-based,
not
deterministic,
and
sees
only
boundary-crossing
requests;
already-allowed
sandbox
actions
bypass
it.
It
adds
model
calls,
while
Computer
Use
app
approvals
still
reach
a
person.
Assert
effective
state,
not
desired
configuration
text.