From 1da20eed5cb0be5172d584363c18e7d2fcef7a5f Mon Sep 17 00:00:00 2001
From: Eva Wong <evawong@openai.com>
Date: Wed, 18 Mar 2026 11:27:32 -0700
Subject: [PATCH] Clarify MDM security requirements errors

---
 codex-rs/core/src/config_loader/macos.rs | 2 +-
 codex-rs/core/src/config_loader/tests.rs | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/codex-rs/core/src/config_loader/macos.rs b/codex-rs/core/src/config_loader/macos.rs
index 56fb6251b8..fe4e3c4015 100644
--- a/codex-rs/core/src/config_loader/macos.rs
+++ b/codex-rs/core/src/config_loader/macos.rs
@@ -235,7 +235,7 @@ fn parse_managed_requirements_base64(encoded: &str) -> io::Result<ConfigRequirem
     {
         return Err(io::Error::new(
             io::ErrorKind::InvalidData,
-            format!("Error parsing managed requirements from {source}: {dropped_entry}"),
+            format!("Error parsing managed security controls from {source}: {dropped_entry}"),
         ));
     }
     for dropped_entry in &sanitized.dropped_entries {
diff --git a/codex-rs/core/src/config_loader/tests.rs b/codex-rs/core/src/config_loader/tests.rs
index a8a6222761..21d549540b 100644
--- a/codex-rs/core/src/config_loader/tests.rs
+++ b/codex-rs/core/src/config_loader/tests.rs
@@ -534,7 +534,7 @@ async fn managed_preferences_ignore_invalid_payload() -> anyhow::Result<()> {
 
 #[cfg(target_os = "macos")]
 #[tokio::test]
-async fn managed_preferences_invalid_requirements_fail_closed() -> anyhow::Result<()> {
+async fn managed_preferences_invalid_security_requirements_fail_closed() -> anyhow::Result<()> {
     use base64::Engine;
 
     for (payload, expected_fragment) in [
@@ -566,11 +566,11 @@ async fn managed_preferences_invalid_requirements_fail_closed() -> anyhow::Resul
             CloudRequirementsLoader::default(),
         )
         .await
-        .expect_err("invalid managed requirements should fail closed");
+        .expect_err("invalid managed security requirements should fail closed");
 
         assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
         let message = err.to_string();
-        assert!(message.contains("Error parsing managed requirements from MDM"));
+        assert!(message.contains("Error parsing managed security controls from MDM"));
         assert!(message.contains(expected_fragment), "{message}");
         assert!(message.contains("bogus"), "{message}");
     }