{"record":{"id":"9ced43553d388eb4","repo":"openai/codex","slug":"restricted-read-only-access-requires-the-elevated","errorCode":null,"errorMessage":"Restricted read-only access requires the elevated Windows sandbox backend","messagePattern":"Restricted read-only access requires the elevated Windows sandbox backend","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/lib.rs","lineNumber":546,"sourceCode":"            .collect::<Vec<_>>();\n        let common = prepare_legacy_spawn_context(\n            permission_profile,\n            workspace_roots,\n            codex_home,\n            cwd,\n            &mut env_map,\n            &command,\n            SpawnPrepOptions {\n                inherit_path: false,\n                add_git_safe_directory: false,\n            },\n        )?;\n        let permissions = common.permissions;\n        let current_dir = common.current_dir;\n        let logs_base_dir = common.logs_base_dir.as_deref();\n        let uses_write_capabilities = common.uses_write_capabilities;\n        if !permissions.has_full_disk_read_access() {\n            anyhow::bail!(\n                \"Restricted read-only access requires the elevated Windows sandbox backend\"\n            );\n        }\n        // WRITE_RESTRICTED tokens consult restricting SIDs only for writes, so this\n        // backend cannot make capability-SID deny-read ACLs authoritative.\n        if !additional_deny_read_paths.is_empty() {\n            anyhow::bail!(\"deny-read overrides require the elevated Windows sandbox backend\");\n        }\n        let capability_roots =\n            legacy_session_capability_roots(&permissions, &current_dir, &env_map, codex_home);\n        let security = prepare_legacy_session_security(\n            uses_write_capabilities,\n            codex_home,\n            cwd,\n            capability_roots,\n        )?;\n        allow_null_device_for_workspace_write(uses_write_capabilities);\n        apply_legacy_session_acl_rules(","sourceCodeStart":528,"sourceCodeEnd":564,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/lib.rs#L528-L564","documentation":"Error \"Restricted read-only access requires the elevated Windows sandbox backend\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/lib.rs:546 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}