From fc758af9eb4ba82af629493d4ada6b0f0ac66973 Mon Sep 17 00:00:00 2001
From: jif-oai <jif@openai.com>
Date: Mon, 20 Apr 2026 11:51:58 +0100
Subject: [PATCH] fix: exec policy loading for sub-agents (#18654)

---
 codex-rs/core/src/exec_policy.rs       |  6 ++++++
 codex-rs/core/src/exec_policy_tests.rs | 16 ++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/codex-rs/core/src/exec_policy.rs b/codex-rs/core/src/exec_policy.rs
index dbc175debc..981b2d11d3 100644
--- a/codex-rs/core/src/exec_policy.rs
+++ b/codex-rs/core/src/exec_policy.rs
@@ -111,6 +111,12 @@ pub(crate) fn child_uses_parent_exec_policy(parent_config: &Config, child_config
     }
 
     exec_policy_config_folders(parent_config) == exec_policy_config_folders(child_config)
+        && parent_config
+            .config_layer_stack
+            .ignore_user_and_project_exec_policy_rules()
+            == child_config
+                .config_layer_stack
+                .ignore_user_and_project_exec_policy_rules()
         && parent_config.config_layer_stack.requirements().exec_policy
             == child_config.config_layer_stack.requirements().exec_policy
 }
diff --git a/codex-rs/core/src/exec_policy_tests.rs b/codex-rs/core/src/exec_policy_tests.rs
index c1abca5cfb..fe4560a781 100644
--- a/codex-rs/core/src/exec_policy_tests.rs
+++ b/codex-rs/core/src/exec_policy_tests.rs
@@ -161,6 +161,22 @@ async fn child_uses_parent_exec_policy_when_non_exec_policy_layers_differ() {
     assert!(child_uses_parent_exec_policy(&parent_config, &child_config));
 }
 
+#[tokio::test]
+async fn child_does_not_use_parent_exec_policy_when_ignore_rules_differs() {
+    let (_home, parent_config) = test_config().await;
+    let mut child_config = parent_config.clone();
+    child_config.config_layer_stack = child_config
+        .config_layer_stack
+        .with_user_and_project_exec_policy_rules_ignored(
+            /*ignore_user_and_project_exec_policy_rules*/ true,
+        );
+
+    assert!(!child_uses_parent_exec_policy(
+        &parent_config,
+        &child_config
+    ));
+}
+
 #[tokio::test]
 async fn child_does_not_use_parent_exec_policy_when_requirements_exec_policy_differs() {
     let (_home, parent_config) = test_config().await;