For a firm running agents in Codex or ChatGPT Work, policy can assign matter budgets, tool allowlists for a review session and ethical-wall denies. The firm retains the signed content-free record locally. These controls describe tool authorization and recorded activity, not legal analysis or model accuracy.
Reviewed trust through config
IT reviews one installation through /hooks, then uses scripts/print-trust-state.cjs to print the exact hooks.state keys and trusted_hash values for its marketplace. Distribute the reviewed TOML through managed configuration.
Managed hooks through MDM
Distribute the reviewed package, Node 22 and dependencies. Configure requirements.toml with allow_managed_hooks_only = true, hooks.managed_dir and all five hook commands. MCP and skills stay installed through the private marketplace.
A changed normalized hook definition changes its hash and prompts review. Referenced script bytes and imported modules are not part of that hash, so IT must protect the reviewed executable files separately. Managed commands need explicit PLUGIN_ROOT and per-user PLUGIN_DATA paths.
On macOS, Codex managed preferences use application identifier com.openai.codex and the keys config_toml_base64 or requirements_toml_base64. The enterprise guide in the plugin repository includes complete TOML, packaging commands and source citations pinned to rust-v0.154.0. Managed-device delivery and Windows execution have not been verified.
