diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs
index e9f6c4bba4..8e43524969 100644
--- a/codex-rs/core/src/config/mod.rs
+++ b/codex-rs/core/src/config/mod.rs
@@ -2706,6 +2706,11 @@ impl Config {
         // Destructure every field to ensure ConfigRequirements additions are
         // either applied above or handled while constructing the final Config.
         let ConfigRequirements {
+            approval_policy: mut constrained_approval_policy,
+            approvals_reviewer: mut constrained_approvals_reviewer,
+            permission_profile: mut constrained_permission_profile,
+            windows_sandbox_mode: mut constrained_windows_sandbox_mode,
+            web_search_mode: mut constrained_web_search_mode,
             allowed_login_methods: _,
             allowed_chatgpt_workspaces: _,
             cli_auth_credentials_store: _,
@@ -2718,12 +2723,7 @@ impl Config {
             allow_login_shell: _,
             shell_environment_policy: _,
             feedback: _,
-            approval_policy: mut constrained_approval_policy,
-            approvals_reviewer: mut constrained_approvals_reviewer,
-            permission_profile: mut constrained_permission_profile,
-            windows_sandbox_mode: mut constrained_windows_sandbox_mode,
             windows_sandbox_private_desktop: _,
-            web_search_mode: mut constrained_web_search_mode,
             allow_managed_hooks_only: _,
             allow_appshots: _,
             allow_remote_control: _,
diff --git a/codex-rs/core/src/config/requirements.rs b/codex-rs/core/src/config/requirements.rs
index b48b80bc6e..c583f10170 100644
--- a/codex-rs/core/src/config/requirements.rs
+++ b/codex-rs/core/src/config/requirements.rs
@@ -13,6 +13,10 @@ use std::collections::BTreeMap;
 use super::otel;
 
 /// Runtime values that cannot be applied by mutating [`ConfigToml`] alone.
+///
+/// Other managed settings are written back into `ConfigToml`. These values need
+/// additional credential-store compatibility handling or intersection with the
+/// configured authentication restrictions before constructing the final config.
 pub(super) struct AppliedConfigRequirements {
     pub cli_auth_credentials_store_mode: AuthCredentialsStoreMode,
     pub forced_login_method: Option<ForcedLoginMethod>,
@@ -21,8 +25,10 @@ pub(super) struct AppliedConfigRequirements {
 
 /// Applies managed requirements to regular config before final config construction.
 ///
-/// Managed values replace their configured counterparts, and conflicts produce
-/// source-aware startup warnings.
+/// Managed values replace or merge with their configured counterparts, and
+/// conflicts produce source-aware startup warnings. Effective authentication
+/// values that need additional resolution are returned separately. Invalid or
+/// conflicting requirements return an error.
 pub(super) fn apply_to_config(
     config: &mut ConfigToml,
     requirements: &ConfigRequirements,