Separate resource approval from execution
Approving an agent allocation gives a project access to a resource. An execution approval answers a later, narrower question: may this agent perform this requested operation? Those decisions can belong to different people and different interfaces.
Read the request in the owner conversation
Managed runtimes start sandboxed. Supported permission requests are routed to a separate owner approval conversation, where the native client displays the relevant operation and scope. The server validates the real sender, request identity, and decision.
Typing “yes” in a project room is not a structured authorization. Public waiting messages do not expose private approval details. Keep ownership and encrypted-room membership intact when recovering a setup.
Choose only the scope you intend
The newer supported Codex integration can offer one-time, task-scoped, and persistent grants, with contributor revocation. Unsupported or ambiguous scopes remain single-use. Read the exact operation and scope shown on the card rather than inferring broad permission.
Explicit contributor-selected execution modes can change the sandbox boundary. Defaults remain sandboxed. Changing future policy or revoking a grant does not undo an operation that has already happened.