diff --git a/codex-rs/execpolicy2/src/decision.rs b/codex-rs/execpolicy2/src/decision.rs
index 71f998ab83..15dc1f711d 100644
--- a/codex-rs/execpolicy2/src/decision.rs
+++ b/codex-rs/execpolicy2/src/decision.rs
@@ -7,8 +7,11 @@ use crate::error::Result;
 #[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub enum Decision {
+    /// Command may run without further approval.
     Allow,
+    /// Request explicit user approval; rejected outright when running with `approval_policy="never"`.
     Prompt,
+    /// Command is blocked without further consideration.
     Forbidden,
 }