A side task can ask for access only if you add a write

Codex can open a side conversation next to the main task, which the reporter uses for log inspection and bug checks so the main thread stays clean. Side conversations get their own developer instructions, and one sentence in them reads: “Do not request escalated permissions or broader sandbox access unless the user explicitly asks for a mutation that requires it.” Issue #53665 shows what that does. Asked to SSH into a server and inspect its ad-fill status, a read-only check that needs network access, Codex declined to even request the access, and said the rule’s wording, not missing user authorisation, was the blocker. When the user added “create 1.txt in the home directory” to the same request, Codex asked, got approval, ran the check and created the file.

The repro is the reporter’s own, on Codex Desktop 26.1007.30912, and was seen only in a side task, not the main one. We checked the open-source code: the same sentence sits in both side-conversation instruction blocks in `codex-rs/tui/src/app/side.rs` (lines 42 and 60) on main at 89461ea and in the latest CLI release, rust-v0.163.0. The issue is open with no fix PR at the time of writing.

A rule that only allows asking for access when there is a write rewards bigger requests. If a read-only check in a side task gets stuck, try it in the main thread, where the reporter did not see the block, rather than inventing a write to unlock the prompt.