Windows Codex app: authorized dependency preparation rejected before process launch with opaque "blocked by policy"

What version of the Codex App are you using (From “About Codex” dialog)?

Not verified from About Codex; omitted rather than guessed.

What subscription do you have?

Not included in this minimal public report.

What platform is your computer?

Windows; exact OS build not verified for this report.

What issue are you seeing?

A bounded, user-authorized local dependency preparation operation in the Codex desktop app was rejected before process launch. The abbreviated error was:

CreateProcess ... blocked by policy

No installation process started on the rejected attempt. The response did not identify the specific rejecting policy or rule, so it was not clear which supported recovery applied. User authorization is not being asserted as an override of platform safety controls.

What steps can reproduce the bug?

Observed sequence, not an independently reproduced minimal test:

1. In Codex desktop on Windows, request a bounded local dependency preparation operation with user authorization.
2. The tool invocation is rejected at process creation with the abbreviated error above, before installation starts.
3. Stop rather than retry through alternate shells, identities, or paths.

No reproduction was rerun for this report. Private command paths, repository identifiers, source, credentials, and full transcripts are intentionally omitted.

What is the expected behavior?

If the operation is correctly denied, expose an actionable explanation of the rejecting layer/rule and a supported recovery or authorization path. Please help determine the refusal source and how to proceed while preserving safety controls, rather than bypassing them.

Additional information

Related: #43905 reports similar error wording. This report concerns dependency preparation rejected before launch; a shared root cause has not been established. No private project files, account details, IP addresses, credentials, or full chat logs are attached.

Start by investigating the Windows process-creation path involved in the Codex desktop app and compare the opaque refusal with related issue #43905. Done means identifying the rejecting policy or rule and documenting a supported recovery or authorization path without bypassing safety controls.