deny-read overrides require the elevated Windows sandbox bac

Error message

deny-read overrides require the elevated Windows sandbox backend

What it means

Error "deny-read overrides require the elevated Windows sandbox backend" thrown in openai/codex.

Source

Thrown at codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs:339

    let common = prepare_legacy_spawn_context(
        permission_profile,
        workspace_roots,
        codex_home,
        cwd,
        &mut env_map,
        &command,
        SpawnPrepOptions {
            inherit_path: false,
            add_git_safe_directory: false,
        },
    )?;
    if !common.permissions.has_full_disk_read_access() {
        anyhow::bail!("Restricted read-only access requires the elevated Windows sandbox backend");
    }
    // WRITE_RESTRICTED tokens consult restricting SIDs only for writes, so this
    // backend cannot make capability-SID deny-read ACLs authoritative.
    if !additional_deny_read_paths.is_empty() {
        anyhow::bail!("deny-read overrides require the elevated Windows sandbox backend");
    }
    let additional_deny_write_paths = additional_deny_write_paths
        .iter()
        .map(AbsolutePathBuf::to_path_buf)
        .collect::<Vec<_>>();
    let capability_roots = legacy_session_capability_roots(
        &common.permissions,
        &common.current_dir,
        &env_map,
        codex_home,
    );
    let security = prepare_legacy_session_security(
        common.uses_write_capabilities,
        codex_home,
        cwd,
        capability_roots,
    )?;
    allow_null_device_for_workspace_write(common.uses_write_capabilities);

View on GitHub (pinned to 339751715c)

Solutions

Enable the elevated Windows sandbox backend for this exec request, or remove the deny-read overrides.

When it happens

Trigger: Thrown at codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs:339 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/73ef359afbc23362. Report an issue: GitHub.