{
  "id": "claim:codex-sandbox-only",
  "_kind": "TestableClaim",
  "_file": "domain/testable-claims/agent-capability-claims.yaml",
  "_cluster": "domain",
  "attributes": {
    "displayName": "Codex defaults to sandbox-only execution",
    "description": "Codex CLI defaults to running all tool calls inside a native sandbox,\npreventing direct file system and network access without explicit\nuser approval.\n",
    "testStatus": "passing",
    "testType": "manual",
    "category": "security",
    "priority": "high"
  },
  "outgoingEdges": [
    {
      "from": "claim:codex-sandbox-only",
      "to": "agent:codex",
      "kind": "asserts_about"
    }
  ],
  "incomingEdges": [
    {
      "from": "experiment:codex-capability-gaps",
      "to": "claim:codex-sandbox-only",
      "kind": "tests_claim"
    }
  ]
}