# Auto Is a Boundary, Not a Bypass

During a long Codex Work Room test, the task itself was ordinary: write a small
C program, compile it, run its tests. The confusing part was at the bottom of
the chat. The operator saw a mode called **Default**, while the Work Room said
that Codex was waiting for a decision. They asked the obvious question: “Is
Auto actually on, or will I still have to approve this?”

That question exposed a product bug, not a naming nit. The stable line spoke
about an auto-approval plugin, the preview line called the same idea a Host
permission profile, and an older session could still carry a legacy marker.
It was too easy to read one of those things as permission for the browser to do
whatever the next provider request required.

At first, renaming the visible button looked like the smallest fix. It would
have made the screenshot nicer, but it would not have answered the operator's
real question after a refresh or a rolling upgrade. A client can remember a
conversation; it must not decide an authorization default. We changed the
shape of the decision instead: the Host starts a session in Read only, owns the
durable profile, and advertises only the choices it is willing to enforce.

The resulting **Auto** profile is deliberately boring. It covers a small,
deterministic class of reversible work inside the selected workspace. A request
outside that boundary still asks or is denied. Delete operations, credentials,
external control, and out-of-workspace writes do not become safe because a
button has a friendly label. Planning remains a workflow state; it is not a
permission grant.

The regression followed the moment that had caused the confusion: reconnect a
browser carrying an old-looking session, choose the advertised profile, then
ask for work that crosses the boundary. The Host keeps the owner and policy
state, while the policy tests distinguish an allowed local edit from an
ambiguous or destructive action.

This is not the future model-reviewed Auto mode. That needs its own reviewer
and acceptance evidence. For now, Auto means something an operator can answer
in one sentence: *the Host may do this narrow kind of workspace work without
asking again; everything broader remains under review.*