diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs
index 0ecedf1952..9c1b419903 100644
--- a/codex-rs/core/src/config/mod.rs
+++ b/codex-rs/core/src/config/mod.rs
@@ -189,7 +189,9 @@ use permission_profile_catalog::permission_profile_is_allowed;
 use permission_profile_catalog::validate_permission_profile_for_deny_read;
 pub use permission_profile_selection::ResolvedPermissionProfileSelection;
 pub use permission_profile_selection::resolve_permission_profile_selection;
+pub use permissions::compile_permission_profile;
 pub(crate) use permissions::is_builtin_permission_profile_name;
+pub use permissions::resolve_permission_profile;
 pub(crate) use resolved_permission_profile::PermissionProfileState;
 
 const DEFAULT_IGNORE_LARGE_UNTRACKED_DIRS: i64 = 200;
diff --git a/codex-rs/core/src/config/permissions.rs b/codex-rs/core/src/config/permissions.rs
index a3b6dc5963..894d9c60ba 100644
--- a/codex-rs/core/src/config/permissions.rs
+++ b/codex-rs/core/src/config/permissions.rs
@@ -194,7 +194,8 @@ pub(crate) fn apply_network_proxy_feature_config(
     }
 }
 
-pub(crate) fn resolve_permission_profile(
+/// Resolves a named permission profile and its inherited configuration.
+pub fn resolve_permission_profile(
     permissions: &PermissionsToml,
     profile_name: &str,
 ) -> io::Result<PermissionProfileToml> {
@@ -347,7 +348,8 @@ pub(crate) fn network_proxy_config_for_profile_selection(
     ))
 }
 
-pub(crate) fn compile_permission_profile(
+/// Compiles a named permission profile into filesystem and network policies.
+pub fn compile_permission_profile(
     permissions: &PermissionsToml,
     profile_name: &str,
     startup_warnings: &mut Vec<String>,