Codex CLI is OpenAI's terminal agent. It runs locally, edits files in your repo, executes commands, and supports the agent skills protocol. For most engineering teams that already use Codex for application code, this is the natural place to also draft authorization policies.
We published a Cerbos policy skill that turns plain English requirements into a validated policy bundle. Inside Codex CLI, the workflow stays in the same shell session you use for everything else. Spec in, bundle out, compiled and tested before commit. Because the skill is grounded in the real compiler and the patterns we've refined across five years of customer work, the output respects schemas, defaults to explicit deny, and writes test fixtures next to the policy.
This guide walks through installing the skill, what a Codex CLI session looks like, how validation runs against the real compiler, and how the skill composes with AGENTS.md.
Installing the policy skill in Codex CLI
Codex CLI added native support for the Agent Skills standard alongside its long-standing AGENTS.md mechanism. The cross-agent installer registers the skill in the directory Codex looks for.
npx skills add cerbos/skills --skill cerbos-policy -a codex
Project-scoped installs land in .agents/skills/cerbos-policy/. Global installs go to ~/.codex/skills/. Codex picks them up the next time you open a session in the repo. The skill source is open at our skills repo for inspection before installing.
Inside Codex CLI, list registered skills with /skills. To explicitly call this one mid-session, type $cerbos-policy and the agent will load the full skill content. Codex will also pick the skill automatically if your description matches what it advertises.
A typical Codex CLI policy session
Run codex in the repo where the Cerbos policies should land. Describe the access model in the same words you'd put on a whiteboard.
"Marketplace app with sellers, buyers, and admins. Sellers manage their own listings. Buyers can read listings and place orders. Admins moderate but cannot see private buyer data. Suspended sellers lose write access."
The skill doesn't jump to YAML. It asks pointed questions first. What counts as private buyer data. Can a suspended seller still respond to existing orders. Are admins scoped to a region. The questions are deliberate because authorization bugs live in the gaps between vague requirements.
Once the spec is confirmed, the skill writes the full bundle in a single pass. You'll see schemas under _schemas/, derived roles, shared variables, resource policies, and a testdata/ directory with fixtures and a test suite. Each file lands in the right place. Every rule has a condition, no wildcard actions, and an explicit deny path.
A note on using AI to write security policies
The Cerbos policy skill is a tool to help you get started. It is not a replacement for human review. Every policy the skill generates still needs eyes on it before it ships, because authorization is security and you should never trust AI with security decisions you haven't reviewed. Use the skill to accelerate the draft, then review like you'd review any other PR.
The review should focus on the deny paths first. The skill is explicit about the assumptions it made along the way, and those assumptions are where most policy mistakes hide. OWASP's broken access control guidance is a good external reference for what reviewers should look for.
How validation works in Codex CLI
The skill validates against the real Cerbos compiler in Docker.
docker run --rm -v "$(pwd):/policies" ghcr.io/cerbos/cerbos:latest compile /policies
When validation fails the skill works through errors in priority order. YAML syntax first, then schema validation, then compile errors, then test failures. One fix per pass. The skill never deletes tests to force passage. After three failed attempts it stops and hands control back to the developer.
When the bundle is green, the skill prints a summary of what it produced and the assumptions it made along the way. Treat the assumptions list as the start of your review.
What Codex CLI adds
Two things stand out.
Codex CLI is shell-native. The session runs alongside git, make, your test runner, and whatever else you already have set up. The policy bundle lands in the same working tree, gets compiled in the same container you use in CI, and shows up in git status ready for a PR. The $cerbos-policy mention pattern keeps invocation deliberate when you want it.
The skill also pairs cleanly with AGENTS.md, which Codex reads from the project root down to the current directory. Putting authorization conventions, deny-by-default reminders, and review notes in AGENTS.md means every Codex session inherits the right defaults before the skill even runs. The two mechanisms compose rather than fight, so your team's policy standards travel with the repo.
When to slow down
A few scenarios deserve more care than a single prompt can give.
Anything that touches money, health data, or regulated information should pair the generated policy with a focused review on the deny paths. The skill writes deny tests by default and the review should confirm those tests match the real constraint.
Multi-tenant systems with cross-tenant escalation usually want a PBAC layer on top of the resource policies. The skill writes this when asked. The boundary between tenant and platform policies is a decision the team needs to make first.
If your repo already has policy structure and conventions, point Codex CLI at it before generating new policies. The skill respects existing structure rather than producing a parallel tree of files. Our authorization failure patterns write-up covers what tends to go wrong when teams skip review.
Getting started
Install the skill, open Codex CLI in your policy repo, and describe the next permission you need. For more on the policy-writing workflow itself, our policy authoring guide covers the same ground from a non-agent angle.
Try Cerbos to deploy and manage the policies the skill produces, or book a workshop to walk through your authorization model with us.
Go deeper:
-
How to adopt externalized authorization (eBook) for the architecture the bundle sits inside
-
Building a scalable authorization system (eBook) for a wider view of the same problem
Using a different agent?
The Cerbos policy skill also works in:
FAQ
Tagged in
