`ProviderAdapterProcessError: codex`

[tech-savvy-guy]

I am using my organization controlled codex with t3 code and I am unable to use it. In the settings, I see myself properly authenticated as my work account:

But when I try to start a new thread I get this error:

Trace below:

ProviderAdapterProcessError: Provider adapter process error (codex) for thread 589a4e73-eac7-4a85-ad81-8503f905c988: failed to load configuration: `approval_policy = "never"` cannot be used because requirements do not allow `sandbox_mode = "danger-full-access"`; Codex would fall back to read-only permissions with approvals disabled. Choose an `approval_policy` based on what you need, such as `on-request`, or choose an allowed sandbox mode.
    at file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:62892:74
    at file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/node_modules/effect/dist/internal/effect.js:1310:96
    at ~effect/Utils/internal (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/node_modules/effect/dist/Utils.js:79:12)
    at startSession (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:76828:59)
    at startSession (definition) (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:39956:30)
    at ensureSessionForThread (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:76908:10)
    at ensureSessionForThread (definition) (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:76765:40)
    at processTurnStartRequested (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:77167:12)
    at processTurnStartRequested (definition) (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:76994:43)
    at processDomainEvent (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:77183:46)
    at processDomainEvent (definition) (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:77151:36) {
  [cause]: CodexAppServerRequestError: failed to load configuration: `approval_policy = "never"` cannot be used because requirements do not allow `sandbox_mode = "danger-full-access"`; Codex would fall back to read-only permissions with approvals disabled. Choose an `approval_policy` based on what you need, such as `on-request`, or choose an allowed sandbox mode.
      at CodexAppServerRequestError.fromProtocolError (file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:44823:10)
      at file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:60636:143
      at file:///C:/Users/<redacted>/AppData/Local/Programs/t3code/resources/app.asar/apps/server/dist/bin.mjs:60629:11 {
    [cause]: Error: failed to load configuration: `approval_policy = "never"` cannot be used because requirements do not allow `sandbox_mode = "danger-full-access"`; Codex would fall back to read-only permissions with approvals disabled. Choose an `approval_policy` based on what you need, such as `on-request`, or choose an allowed sandbox mode.
  }
}

[NicL9923]

I'm thinking this is because the default setting is to "allow all", and your org's policies don't allow that? Maybe try the "Supervised" mode depicted below

[t3dotgg]

Thanks for the detailed report. We believe this is resolved by selecting Supervised or Auto-accept edits when the Codex organization policy forbids danger-full-access.

The exact Codex error says the organization forbids danger-full-access, while the selected T3 mode requests that permission with approval_policy never. This is policy enforcement, not failed authentication. T3 already exposes Supervised and Auto-accept edits, which request restricted sandbox modes and permit approvals. This is not a merged fix or a reporter-confirmed resolution. Inheriting a named Codex permission profile is a separate feature request.

I'm closing this as a configuration or support resolution as part of an automated pass on all open issues. This does not claim that T3 Code shipped a code fix. If new evidence shows that current T3 Code causes the problem, please reply with the version and reproduction details, and we can reopen it.