Keep separate setups with profiles
configuration
// what it does
A [profiles.NAME] table in config.toml bundles a set of overrides — model, approval, sandbox — that you activate with --profile NAME (or -p). A ci profile might set approval_policy = "never" while your interactive default stays cautious. CLI -c still overrides a profile.
// shell
$ codex --profile ci "run the checks"$ codex -p work "start on today's task"// gotcha
A profile only changes the keys it sets; everything else falls back to the top-level config, so a partial profile can inherit surprises. Precedence is CLI/-c, then profile, then config file, then defaults.