[Desktop][Auto-review UX] Denial provides no human approval path and forces exact "magic sentence" authorization

Summary

I am strongly dissatisfied with the current Approve for me / Auto-review authorization UX in Codex Desktop.

Auto-review can deny a concrete, user-authorized escalation without showing a native human approval dialog. The agent is then forced to stop and ask the user to type an exact sentence containing the local payload and remote destination. This behaves like a hidden “magic phrase” requirement rather than a usable permission system.

This report is not asking OpenAI to remove safeguards or allow unrestricted access. It is asking for a transparent, direct, human-controlled approval path when Auto-review is uncertain or denies an otherwise user-authorized action.

Environment

• Codex Desktop for Windows
• App version: 26.825.4187.0
• Permission profile: workspace write
• Approval reviewer: auto_review / “Approve for me”
• Date observed: 2026-08-29
• Workflow: authorized maintenance of the user’s own remote Linux host
• Sensitive host details, credentials, private code, and patch contents are intentionally omitted

What happened

1. The user explicitly authorized continued maintenance work on their own remote server, including file upload and deployment steps.
2. A small patch was created inside the active local workspace.
3. The agent requested the required escalation to upload that exact patch to a temporary path on the authorized remote host.
4. Auto-review denied the request because the prior authorization was treated as insufficiently exact about the payload and destination.
5. Codex Desktop did not show the user a native approval dialog for the denied action.
6. The workflow stopped, and the agent had to ask the user to type an exact sentence such as “Allow upload [exact local file] to [exact remote path].”
7. Broad but clear user messages such as “allow all operations” still did not provide a direct, durable approval path.

The official Auto-review documentation says the reviewer replaces the person at the sandbox boundary and that a denied action may require the agent to stop and ask the user. It also documents a narrow /approve override path in the TUI. In the desktop experience, however, no equivalent one-click override was surfaced during this workflow.

Documentation: https://learn.chatgpt.com/docs/sandboxing/auto-review

Why this UX is unacceptable

• The user is present and willing to approve, but the product withholds the normal approval control.
• The exact action is already available to the reviewer in the escalation request, yet the burden is shifted to the user to restate file and destination details manually.
• Authorization becomes dependent on wording rather than a clear UI decision.
• Repeated authorized maintenance actions become needlessly fragile and interrupt long-running work.
• The behavior is confusing: “Approve for me” sounds like reduced friction, but a denial can leave the user with less control than ordinary manual approval.
• The product does not clearly explain which permission mode caused the denial or provide a direct route to change that mode for the current task.

Expected behavior

When Auto-review denies an action and the user is available, Codex Desktop should:

1. Surface a native Approve once / Always allow within this scope / Deny control for the exact action.
2. Offer a one-click human override and retry equivalent to the documented TUI /approve flow.
3. Allow durable but narrowly scoped authorization, such as:
   • this host for this task,
   • this remote temporary directory,
   • this upload helper or command prefix,
   • this project/workspace for the current session.
4. Treat clear, scoped user authorization as relevant evidence instead of requiring an exact “magic sentence.”
5. Explain the denial with structured fields: action, payload, destination, risk, missing authorization, active permission mode, and a direct settings link.
6. Never force the assistant to invent an approval ritual in ordinary chat when a native approval dialog can represent the decision more safely and precisely.

Actual behavior

• Auto-review denied the action.
• No human approval dialog appeared.
• No clear desktop override was offered.
• The agent had to stop and request exact textual authorization.
• The user became understandably frustrated and the authorized workflow was interrupted.

Requested product change

Please add a first-class desktop escalation fallback: when Auto-review denies an approvable action, hand the exact request to the user in the UI instead of converting the denial into a dead end.

Security policy can still forbid non-overridable actions. But for actions that are eligible for user authorization, the user must receive an explicit, usable control rather than a wording puzzle.

This is a serious usability problem in long-running Codex workflows and should be treated as a product-level permissions UX defect.

Start at the Codex Desktop Auto-review denial flow on Windows and read the linked Auto-review documentation, especially the documented TUI /approve path. Compare the desktop behavior with the requested human approval fallback; done means an eligible denial exposes a clear, scoped approval or retry control without requiring an exact sentence.