Before you start
- A workflow, or one you're about to create (schedule a workflow).
- A rough idea of what each step does: read, run tests or tools, or change code.
Steps
- Open the step's permissions chipIn the workflow editor, each step card has its own permissions chip next to its model and effort. New steps start at Read-only.
- Start from the least the step needsPick Read-only for steps that only read and summarise, Can run commands for steps that run tests, builds, linters,
gitorgh, and Can edit files only for steps that change code. - Keep Ask me first on editing stepsChoosing Can edit files for a later step turns on Ask me first by itself: the run pauses before that step with Run it and Stop in a notification and on the run's page. It isn't turned on for Can run commands.
- Say what must not happen in the promptFor steps that can run commands, write the limits into the prompt, for example "don't push, don't post comments". The level controls tools, not intent.
- Isolate command stepsRun Can run commands and Can edit files steps in a clean checkout or a worktree, so anything they write doesn't mix with your work in progress.
For Codex command/edit steps that need GitHub or another online service, choose Network access → Enabled in the workflow editor. Use Codex settings preserves the existing configuration; Disabled explicitly keeps those steps offline. This retains the workspace file sandbox and does not widen read-only planning or goal checks.
Exactly what each level runs with
| Level | What it may do | Claude runs with | Codex runs with |
|---|---|---|---|
| Read-only | read and search files; no commands, no edits | --permission-mode default --disallowedTools Edit Write MultiEdit NotebookEdit Bash | -s read-only |
| Can run commands | also run shell commands (tests, builds, linters, git, gh), but not edit files with its edit tools | --permission-mode default --allowedTools Bash --disallowedTools Edit Write MultiEdit NotebookEdit | -s workspace-write |
| Can edit files | change files and run commands, with nobody approving each edit | --permission-mode acceptEdits --allowedTools Bash | -s workspace-write |
Every level is an explicit mode, so your own Claude defaultMode and allow rules never widen it, and denied tools win over your allow rules.
Two caveats worth knowing
How to pick, by example
| Step | Level |
|---|---|
| Summarise yesterday's merged PRs from the git log | Read-only |
| Run the test suite and report failures | Can run commands |
Triage new issues with gh and draft replies (nothing posted) | Can run commands |
| Fix the failing test and open a PR | Can edit files, with Ask me first |
| Review the fix | Read-only, or Can run commands to re-run tests |
The planner, the goal check and the doctor always only look, whatever the steps may do: on Claude they get Read, Glob and Grep; on Codex the read-only sandbox. The doctor may lower a step's level but never raises it.
Troubleshooting
- A Read-only Claude step can't run the tests
- Read-only removes Bash. Switch the step to Can run commands.
- A Read-only Codex step's build fails
- Codex's read-only sandbox lets commands start but not write, which breaks most builds. Use Can run commands and tell the prompt not to edit.
- A step fails waiting for a permission prompt
- Headless runs can't ask. Raise the step to the level it needs rather than relying on approvals mid-step.
Frequently asked questions
- Does my Claude settings.json allow list affect workflow steps?
- No. Each level sets an explicit permission mode and tool lists, so your own
defaultModeand allow rules never widen it, and denied tools win. - Is Can run commands safe for a repo I'm working in?
- Not fully: commands can write files (caches, build output, anything a script does). Use a clean checkout or a worktree and state in the prompt what it must not do.
- Why do Codex's Can run commands and Can edit files behave the same?
- Both use Codex's
workspace-writesandbox, because Codex has no mode that allows commands but blocks edits. Only the prompt keeps a Can run commands step from editing.
Related
- DocsWorkflowsScheduled prompts, check-ins on a chat, run history, limits
- GuideSchedule a Claude Code or Codex workflow on your MacDescribe a job, let Claude or Codex plan it, review the plan, pick a schedule and a limit threshold, and create the workflow.
- GlossaryPermission modeThe Claude Code setting that decides which actions Claude may take in a session without asking you first.
- GlossaryCodex sandbox modesThe settings that limit what Codex's commands can touch: read-only, workspace-write (the usual default) or danger-full-access.
- Use caseRun scheduled coding workflows with Claude Code and CodexDescribe a recurring job; your Claude or Codex plans steps in parallel waves, and Pairbar runs them on schedule within your limits.
Try Pairbar free for 7 days
One sidebar for the Claude and Codex desktop apps. Everything on for 7 days, no card needed; then $49/year ($39 first year with LAUNCH), $9/month or $129 lifetime (first 200 buyers). macOS 26 or later, Apple silicon.