diff --git a/codex-rs/execpolicy2/src/decision.rs b/codex-rs/execpolicy2/src/decision.rs
index 96cf76ed9d..71f998ab83 100644
--- a/codex-rs/execpolicy2/src/decision.rs
+++ b/codex-rs/execpolicy2/src/decision.rs
@@ -4,7 +4,7 @@ use serde::Serialize;
 use crate::error::Error;
 use crate::error::Result;
 
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub enum Decision {
     Allow,
@@ -21,13 +21,4 @@ impl Decision {
             other => Err(Error::InvalidDecision(other.to_string())),
         }
     }
-
-    /// Returns true if `self` is stricter (less permissive) than `other`.
-    pub fn is_stricter_than(self, other: Self) -> bool {
-        matches!(
-            (self, other),
-            (Decision::Forbidden, Decision::Prompt | Decision::Allow)
-                | (Decision::Prompt, Decision::Allow)
-        )
-    }
 }
diff --git a/codex-rs/execpolicy2/src/policy.rs b/codex-rs/execpolicy2/src/policy.rs
index 27024b1af2..73764ffbc4 100644
--- a/codex-rs/execpolicy2/src/policy.rs
+++ b/codex-rs/execpolicy2/src/policy.rs
@@ -42,13 +42,7 @@ impl Policy {
             if let Some(matched) = rule.matches(cmd) {
                 let decision = match best_decision {
                     None => matched.decision,
-                    Some(current) => {
-                        if matched.decision.is_stricter_than(current) {
-                            matched.decision
-                        } else {
-                            current
-                        }
-                    }
+                    Some(current) => std::cmp::max(matched.decision, current),
                 };
                 best_decision = Some(decision);
                 matched_rules.push(matched);