Add command rules and review hooks
Rules match the start of a command: prompt asks you before it runs, forbidden refuses it, and allow lets it run outside the sandbox without asking. The strictest matching rule wins, and a rule with no decision is an allow rule (Codex docs).
A small rules file that asks before git push, publishing and infrastructure commands and forbids recursive deletes covers the commands that do the most damage. Copy the rules from the audit’s fix section and test them with codex execpolicy check.
Hooks and notify run your commands on agent events. Codex runs a non-managed hook only after you trust its exact definition in /hooks, so read each one, and never use --dangerously-bypass-hook-trust on your own machine.