Agentic loop - The work cycle: the model gets context, chooses a tool, the runtime checks approval/sandbox/execpolicy, the tool runs or is blocked, the result returns to the model, the loop continues.
Approvals - The stop policy: when an action (an edit, a command, network egress) must ask a human; set by the approval policy and the session's autonomy level.
Sandbox - Execution isolation: read-only, workspace-write with protected paths and a network boundary; it limits what commands and tools may touch beyond what is allowed.
Execpolicy - Command-prefix rules: allow, prompt, forbidden; they deterministically decide a shell call's fate before it runs and are checked with unit tests.
Permission profile - A reusable set of filesystem and network policy applied to a session or task instead of configuring each one by hand.
config.toml - Codex's main settings file with layers and precedence (CLI override > project > user > built-in); each key affects session behavior.
AGENTS.md - The repository's durable contract: project instructions loaded into context, with nested overrides at the subdirectory level.
Memories / Chronicle - Accumulation of experience between sessions and a work journal; auxiliary memory separate from the committed AGENTS.md.
Skills - A repeatable procedure as a skill with progressive disclosure and triggers: loaded by relevance rather than loaded whole upfront.
Custom agents - A separate role with its own model, configuration and a narrower sandbox; it isolates a task and its authority from the main session.
Plugins - An installable bundle of skills, connectors, MCP servers and hooks; a distributable set of customization with a version.
Hooks - Deterministic reactions to lifecycle events with a trust hash and matchers: a script that can allow, modify or block an action.
MCP - Model Context Protocol: connecting external servers (stdio, Streamable HTTP) with their tools, auth and tool policy; it extends the agent's actions beyond the built-in ones.
Sessions - The conversation's state: new, resume, fork, side, archive, delete and compaction; the work history you return to between runs.
codex exec - A non-interactive run: stdin as input, stdout/stderr and JSONL as output, structured output; the basis for scripts and CI.
Codex SDK / App Server - An SDK with threads and turns for integration in Node.js and Python; the App Server is a protocol host with transports, auth and lifecycle for embedding Codex.
Trust / prompt injection - Untrusted external content (fetched, files, tool output) is data, not commands; the real security boundary is in approvals, the sandbox and execpolicy, not the prompt.
Managed config - Organization-level settings (enterprise) that override user ones; they set the provider, requirements, analytics and permissions centrally.