Collaboration: Complementary governance layer for Codex execution policies

[imran-siddique]

Hi @etraut-openai

We moved our project to microsoft/agent-governance-toolkit and wanted to explore how our runtime governance could complement Codex's existing execution policy rules.

Acknowledging what exists: Codex already has execution policy rules and monitoring/telemetry - that's great foundational work. Our toolkit operates at a different layer that could extend those capabilities:

Where we see complementary value:

1. Dynamic policy evaluation - Codex rules are configured per-session. Our policy engine evaluates rules per-action based on runtime context (what has the agent done so far, what resources has it accessed, what's the current trust state).
2. Cross-agent governance - When Codex agents interact with external services or other agents, our trust verification protocol provides identity and capability attestation.
3. Audit provenance - Merkle-chain audit trails that provide tamper-evident records of every action, useful for enterprise compliance requirements.

What we'd like to understand:

1. Is there an extension/plugin model for Codex execution policies, or is it intentionally closed?
2. Does Codex expose lifecycle hooks (pre/post tool execution) that external governance could plug into?
3. What's the team's thinking on enterprise governance requirements - is that on the roadmap?

Not looking to replace anything - just exploring whether there's a natural extension point where our runtime governance adds value on top of Codex's existing controls.

Repo: microsoft/agent-governance-toolkit

[etraut-openai]

Moving to discussion since this isn't a feature request or bug report.

[etraut-openai]

We are working on event (lifecycle) hooks. See here for the feature request.

See here for documentation about enterprise governance features. If you'd like to see additional features here, please file a feature request or talk to the OpenAI Codex enterprise sales team.