# Claude Code vs Codex CLI: Permission Models Compared

The complete comparison of Claude Code and Codex CLI permission systems — approval modes, hook events and coverage, deny rules, sandboxing, and what each does in unattended mode. With the honest gaps in both.

Claude Code and OpenAI's Codex CLI both ship permission systems, both ship hooks, and both get run unattended by people who read neither system's fine print. The models look similar from a distance — `PreToolUse`, `PostToolUse`, JSON in, JSON out — and behave differently in exactly the places that matter for governance. This is the side-by-side, with sources.

## The comparison

| Dimension | Claude Code | Codex CLI |
|---|---|---|
| Hook config | `~/.claude/settings.json` | `~/.codex/hooks.json` (user) merged with `<repo>/.codex/hooks.json` |
| Hook events | `PreToolUse`, `PostToolUse` | `PreToolUse`, `PostToolUse` |
| Enabled by default | Yes | Yes since 0.145 (`[features].hooks`); older builds needed `codex_hooks = true` |
| Tool coverage | All native tools: `Bash`, `Edit`, `Read`, `Write`, MCP | `shell` (Bash) only, by design — `apply_patch`, file tools, and MCP calls never fire hooks |
| Operational decisions | `allow` / `deny` / `ask`, plus input rewriting | `deny` only — `allow`, `ask`, `updatedInput` are parsed and rejected ([output_parser.rs](https://github.com/openai/codex/blob/main/codex-rs/hooks/src/engine/output_parser.rs)) |
| Output-side control | `PostToolUse` can redact/rewrite tool output | Observe-only (`updatedMCPToolOutput` rejected) |
| Unattended mode | `--dangerously-skip-permissions` — removes prompts, **hooks and denies still run** | `codex exec --full-auto` — **keeps hooks running**, sandboxes writes, blocks network by default |
| Sandbox | OS-level sandboxing on supported platforms | `workspace-write` sandbox + opt-in network (`sandbox_workspace_write.network_access=true`) |
| Hook timeout | ~4s default | ~30s — headroom for remote policy lookups |
| Approval prompt | Per-action ask with allow-once/always | Per-step Y/N; suppressed (not disabled) in `--full-auto` |

Both are real permission systems. Neither is a complete one, and they're incomplete in *opposite* ways.

## Where Claude Code is stronger: coverage and decisions

Claude Code's hook surface sees everything the agent does natively — shell, file edits, reads, writes, MCP tool calls — and its hooks can make every decision worth making: allow, deny, escalate to a human (`ask`), or rewrite the input before it runs. If your governance model needs "redact the secret from that tool output before the model sees it," Claude Code's `PostToolUse` can do it and Codex's cannot.

The catch sits at the flag people actually use for automation. `--dangerously-skip-permissions` suppresses the approval prompts; it does not disable hooks — PreToolUse still fires and a deny still blocks. What goes missing unattended is the human confirmation, so the moment a Claude Code deployment runs with that flag, the deny rules written beforehand are its entire boundary. (Details and safer patterns: [our dangerously-skip-permissions breakdown](/blog/claude-code-dangerously-skip-permissions).)

## Where Codex is stronger: unattended behavior

Codex made the opposite call: `--full-auto` removes the *human*, not the *policy*. Hooks keep firing, filesystem writes stay sandboxed to the workspace, and network is off unless you grant it. For CI agents, scheduled jobs, and headless deployments, that's the correct architecture — and it's the single strongest governance property in either CLI.

The catch is reach. Hooks intercept the `shell` tool only, and the only decision Codex acts on is `deny` with a reason. No `ask` escalation, no input rewriting, no coverage of `apply_patch` or MCP-routed tools. A Codex hook is a tripwire, not a control plane. (Full reference, including the flag that silently no-ops everything: [Codex CLI hooks reference](/blog/codex-cli-hooks-reference).)

## The shared gap

Both models decide *per call* with *local* context: this command, this session, this machine. Neither can answer the questions that make unattended operation actually safe:

- **Identity** — which human is accountable for this agent's actions, and does the record survive the machine?
- **Cumulative behavior** — the 400th `curl` in an hour is a different event than the 1st; per-call rules can't see the series.
- **Spend** — neither CLI meters cost at decision time; a retry loop at 3am is invisible until the invoice.
- **Fleet policy** — a deny-list edited per machine, per developer, drifts. There's no "this rule, everywhere, now."

That's the layer ACP adds to both — the same server-side policy, audit trail, and spend metering behind Claude Code's full-coverage hooks and Codex's deny-only ones, with each harness's mapping documented honestly (Codex needs an MCP-connector supplement for the tools its hooks can't see). One install covers either: [Ways to set up ACP](/docs/setup).

## Choosing, if you must

- **Interactive daily driving:** either — both approval UIs are fine with a human present.
- **Unattended with governance requirements:** Codex's `--full-auto` is architecturally right; pair it with server-side policy to compensate for deny-only/Bash-only reach. Unattended Claude Code under `--dangerously-skip-permissions` keeps hooks alive; write the denies first and add the wrapper-level controls.
- **Output redaction / PII handling in the loop:** Claude Code — it's the only one with an operational output-side hook.
- **Mixed fleet:** stop choosing per-harness semantics; put the policy at a layer both route through, and let the harness-level systems be the local reflexes they're good at.

## Frequently asked questions



## Where to read more

- [Codex CLI hooks reference](/blog/codex-cli-hooks-reference) — the full Codex hook surface, with source cites
- [Claude Code's dangerously-skip-permissions](/blog/claude-code-dangerously-skip-permissions) — what the flag actually disables
- [Which Claude Code tools to deny out of the box](/blog/which-claude-code-tools-to-deny-out-of-the-box) — posture, tool by tool
- [The Tool Surface Index](/tool-surfaces) — Claude Code's 76 declared tools next to Codex's 17, from live traffic
- [Ways to set up ACP](/docs/setup) — both planes, per stack, ending with your coverage state