diff --git a/codex-rs/core/tests/suite/executor_discovery_v2.rs b/codex-rs/core/tests/suite/executor_discovery_v2.rs
index e443ed1cd3..73d6d45d0c 100644
--- a/codex-rs/core/tests/suite/executor_discovery_v2.rs
+++ b/codex-rs/core/tests/suite/executor_discovery_v2.rs
@@ -885,10 +885,10 @@ async fn v2_discovery_cache_reuses_matching_requests_and_isolates_execution_cont
     assert_eq!(calls().await, 1);
     let restricted = codex_exec_server::DiscoverV2CapabilitiesRequest {
         sandbox: Some(
-            codex_exec_server::FileSystemSandboxContext::from_legacy_sandbox_policy(
-                codex_protocol::protocol::SandboxPolicy::new_read_only_policy(),
+            codex_exec_server::FileSystemSandboxContext::from_permission_profile(
+                codex_protocol::models::PermissionProfile::read_only(),
                 request.cwd.clone(),
-            )?,
+            ),
         ),
         ..request.clone()
     };
diff --git a/codex-rs/exec-server/src/discoverV2/tests/capability_manager_tests.rs b/codex-rs/exec-server/src/discoverV2/tests/capability_manager_tests.rs
index 996492181e..8e639d01fd 100644
--- a/codex-rs/exec-server/src/discoverV2/tests/capability_manager_tests.rs
+++ b/codex-rs/exec-server/src/discoverV2/tests/capability_manager_tests.rs
@@ -3,7 +3,7 @@
 use super::*;
 use crate::discover_v2::capability_locations::tests::request;
 use crate::discover_v2::capability_locations::tests::write;
-use codex_protocol::protocol::SandboxPolicy;
+use codex_protocol::models::PermissionProfile;
 use codex_utils_path_uri::PathUri;
 use pretty_assertions::assert_eq;
 
@@ -69,10 +69,10 @@ async fn discovery_responses_are_cached_by_sandbox_context() -> anyhow::Result<(
     for index in 0..MAX_CACHED_SANDBOX_CONTEXTS {
         let sandbox_cwd = cwd.join(&format!("context-{index}"))?;
         let sandbox = DiscoverV2CapabilitiesRequest {
-            sandbox: Some(FileSystemSandboxContext::from_legacy_sandbox_policy(
-                SandboxPolicy::DangerFullAccess,
+            sandbox: Some(FileSystemSandboxContext::from_permission_profile(
+                PermissionProfile::Disabled,
                 sandbox_cwd,
-            )?),
+            )),
             ..params.clone()
         };
         let response = manager.get_or_refresh_discovery(sandbox.clone()).await?;
diff --git a/codex-rs/exec-server/src/discoverV2/tests/capability_watchers_tests.rs b/codex-rs/exec-server/src/discoverV2/tests/capability_watchers_tests.rs
index 65ccf360be..c9cc807c6d 100644
--- a/codex-rs/exec-server/src/discoverV2/tests/capability_watchers_tests.rs
+++ b/codex-rs/exec-server/src/discoverV2/tests/capability_watchers_tests.rs
@@ -136,10 +136,10 @@ async fn watch_events_invalidate_discovery_and_no_subscription_disables_caching(
             .any(|skill| skill.path == demo_skill && skill.description == "ready")
     );
     let sandbox_params = DiscoverV2CapabilitiesRequest {
-        sandbox: Some(crate::FileSystemSandboxContext::from_legacy_sandbox_policy(
-            codex_protocol::protocol::SandboxPolicy::DangerFullAccess,
+        sandbox: Some(crate::FileSystemSandboxContext::from_permission_profile(
+            codex_protocol::models::PermissionProfile::Disabled,
             params.cwd.clone(),
-        )?),
+        )),
         ..params.clone()
     };
     manager.get_or_refresh_discovery(sandbox_params).await?;
diff --git a/codex-rs/exec-server/src/server/file_system_handler.rs b/codex-rs/exec-server/src/server/file_system_handler.rs
index 199c1188fd..fe5bd75d3f 100644
--- a/codex-rs/exec-server/src/server/file_system_handler.rs
+++ b/codex-rs/exec-server/src/server/file_system_handler.rs
@@ -369,8 +369,8 @@ fn map_fs_error(err: io::Error) -> JSONRPCErrorError {
 
 #[cfg(test)]
 mod tests {
-    use codex_protocol::protocol::NetworkAccess;
-    use codex_protocol::protocol::SandboxPolicy;
+    use codex_protocol::models::PermissionProfile;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use codex_utils_path_uri::PathUri;
     use pretty_assertions::assert_eq;
 
@@ -389,20 +389,16 @@ mod tests {
         .expect("runtime paths");
         let handler = FileSystemHandler::new(runtime_paths);
         let sandbox_cwd = PathUri::from_host_native_path(temp_dir.path()).expect("tempdir URI");
-        let sandbox_context = |sandbox_policy| {
-            FileSystemSandboxContext::from_legacy_sandbox_policy(
-                sandbox_policy,
-                sandbox_cwd.clone(),
-            )
-            .expect("sandbox context")
+        let sandbox_context = |permissions| {
+            FileSystemSandboxContext::from_permission_profile(permissions, sandbox_cwd.clone())
         };
 
-        for (file_name, sandbox_policy) in [
-            ("danger.txt", SandboxPolicy::DangerFullAccess),
+        for (file_name, permission_profile) in [
+            ("danger.txt", PermissionProfile::Disabled),
             (
                 "external.txt",
-                SandboxPolicy::ExternalSandbox {
-                    network_access: NetworkAccess::Restricted,
+                PermissionProfile::External {
+                    network: NetworkSandboxPolicy::Restricted,
                 },
             ),
         ] {
@@ -414,7 +410,7 @@ mod tests {
                     path: path.clone(),
                     follow_symlinks: None,
                     data_base64: STANDARD.encode("ok"),
-                    sandbox: Some(sandbox_context(sandbox_policy.clone())),
+                    sandbox: Some(sandbox_context(permission_profile.clone())),
                 })
                 .await
                 .expect("write file");
@@ -422,7 +418,7 @@ mod tests {
             let canonicalized = handler
                 .canonicalize(FsCanonicalizeParams {
                     path: path.clone(),
-                    sandbox: Some(sandbox_context(sandbox_policy.clone())),
+                    sandbox: Some(sandbox_context(permission_profile.clone())),
                 })
                 .await
                 .expect("canonicalize file");
@@ -438,7 +434,7 @@ mod tests {
                 .read_file(FsReadFileParams {
                     path,
                     follow_symlinks: None,
-                    sandbox: Some(sandbox_context(sandbox_policy)),
+                    sandbox: Some(sandbox_context(permission_profile)),
                 })
                 .await
                 .expect("read file");
diff --git a/codex-rs/exec-server/src/server/process_otel_tests.rs b/codex-rs/exec-server/src/server/process_otel_tests.rs
index 69588b7996..6b1d0b3421 100644
--- a/codex-rs/exec-server/src/server/process_otel_tests.rs
+++ b/codex-rs/exec-server/src/server/process_otel_tests.rs
@@ -407,9 +407,10 @@ fn exported_sandbox_denial_keeps_launch_identity_and_separate_exit_outcome() {
             let private_file = directory.path().join(PRIVATE_PAYLOAD);
             std::fs::write(&private_file, PRIVATE_PAYLOAD).expect("write test file");
             let cwd = PathUri::from_host_native_path(directory.path()).expect("cwd URI");
-            let sandbox = crate::FileSystemSandboxContext::from_legacy_sandbox_policy(
-                codex_protocol::protocol::SandboxPolicy::new_read_only_policy(), cwd.clone(),
-            ).expect("read-only sandbox");
+            let sandbox = crate::FileSystemSandboxContext::from_permission_profile(
+                codex_protocol::models::PermissionProfile::read_only(),
+                cwd.clone(),
+            );
             for (index, span) in LAUNCH_SPANS.into_iter().enumerate() {
                 let process_id = format!("{PRIVATE_PAYLOAD}-{index}");
                 let launch = format!("00-{TRACE_ID}-{span}-00");
diff --git a/codex-rs/exec-server/tests/capabilities_v2.rs b/codex-rs/exec-server/tests/capabilities_v2.rs
index 2cc49bac28..57ebe74a80 100644
--- a/codex-rs/exec-server/tests/capabilities_v2.rs
+++ b/codex-rs/exec-server/tests/capabilities_v2.rs
@@ -169,10 +169,10 @@ async fn v2_rpc_refreshes_metadata_and_enforces_sandbox() -> anyhow::Result<()>
                     .contains("cannot enforce split filesystem read restrictions")),
                 "{error:#}"
             );
-            let mut sandbox = FileSystemSandboxContext::from_legacy_sandbox_policy(
-                codex_protocol::protocol::SandboxPolicy::new_read_only_policy(),
+            let mut sandbox = FileSystemSandboxContext::from_permission_profile(
+                PermissionProfile::read_only(),
                 cwd.clone(),
-            )?;
+            );
             sandbox.windows_sandbox_selection =
                 codex_exec_server::WindowsSandboxSelection::RestrictedToken;
             let permitted = DiscoverV2CapabilitiesRequest {
diff --git a/codex-rs/exec-server/tests/exec_process.rs b/codex-rs/exec-server/tests/exec_process.rs
index 68235743d8..26f5ec6e8e 100644
--- a/codex-rs/exec-server/tests/exec_process.rs
+++ b/codex-rs/exec-server/tests/exec_process.rs
@@ -59,7 +59,6 @@ use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::FileSystemSpecialPath;
 #[cfg(unix)]
 use codex_protocol::permissions::NetworkSandboxPolicy;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_utils_path_uri::PathUri;
 use pretty_assertions::assert_eq;
 use tempfile::TempDir;
@@ -1904,10 +1903,10 @@ async fn assert_remote_windows_sandbox_process_write(
     let workspace = TempDir::new()?;
     let blocked_file = workspace.path().join("blocked.txt");
     let cwd = PathUri::from_host_native_path(workspace.path())?;
-    let mut sandbox = FileSystemSandboxContext::from_legacy_sandbox_policy(
-        SandboxPolicy::new_read_only_policy(),
+    let mut sandbox = FileSystemSandboxContext::from_permission_profile(
+        codex_protocol::models::PermissionProfile::read_only(),
         cwd.clone(),
-    )?;
+    );
     match expected_sandbox_type {
         codex_sandboxing::SandboxType::WindowsRestrictedToken => {
             sandbox.windows_sandbox_selection = WindowsSandboxSelection::RestrictedToken;
diff --git a/codex-rs/exec-server/tests/file_system_windows.rs b/codex-rs/exec-server/tests/file_system_windows.rs
index aa043d371a..7fbb52b5da 100644
--- a/codex-rs/exec-server/tests/file_system_windows.rs
+++ b/codex-rs/exec-server/tests/file_system_windows.rs
@@ -30,7 +30,6 @@ use codex_protocol::permissions::FileSystemSandboxEntry;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::FileSystemSpecialPath;
 use codex_protocol::permissions::NetworkSandboxPolicy;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_sandboxing::SandboxType;
 use codex_utils_path_uri::PathUri;
 use codex_windows_sandbox_test_support::WindowsSandboxAccountTestGuard;
@@ -746,8 +745,8 @@ fn process_private_desktops() -> Result<BTreeSet<String>> {
 }
 
 fn read_only_sandbox_for_cwd(cwd: std::path::PathBuf) -> Result<FileSystemSandboxContext> {
-    Ok(FileSystemSandboxContext::from_legacy_sandbox_policy(
-        SandboxPolicy::new_read_only_policy(),
+    Ok(FileSystemSandboxContext::from_permission_profile(
+        PermissionProfile::read_only(),
         PathUri::from_host_native_path(cwd)?,
-    )?)
+    ))
 }
diff --git a/codex-rs/ext/skills/src/host_roots_tests.rs b/codex-rs/ext/skills/src/host_roots_tests.rs
index b2ff64b5e7..286a3b564a 100644
--- a/codex-rs/ext/skills/src/host_roots_tests.rs
+++ b/codex-rs/ext/skills/src/host_roots_tests.rs
@@ -27,7 +27,6 @@ use codex_exec_server::WriteFileOptions;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::SkillScope;
 use codex_skills::SkillMetadata;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -593,11 +592,10 @@ async fn empty_remote_repo_skills_are_reused_until_watch_invalidation() {
     // The same executor with different captured permissions must scan again.
     let read_only = FileSystemEnvironmentAccessor::new(
         &remote,
-        FileSystemSandboxContext::from_legacy_sandbox_policy(
-            SandboxPolicy::new_read_only_policy(),
+        FileSystemSandboxContext::from_permission_profile(
+            PermissionProfile::read_only(),
             PathUri::from_abs_path(&cwd),
-        )
-        .unwrap(),
+        ),
     );
     assert!(
         service
@@ -699,11 +697,10 @@ async fn incomplete_project_marker_probe_is_retried_before_loading_parent_skills
     calls.denied_marker.lock().unwrap().take();
     let read_only = FileSystemEnvironmentAccessor::new(
         &remote,
-        FileSystemSandboxContext::from_legacy_sandbox_policy(
-            SandboxPolicy::new_read_only_policy(),
+        FileSystemSandboxContext::from_permission_profile(
+            PermissionProfile::read_only(),
             PathUri::from_abs_path(&cwd),
-        )
-        .unwrap(),
+        ),
     );
     assert!(
         service
diff --git a/codex-rs/file-system/src/lib.rs b/codex-rs/file-system/src/lib.rs
index 9e032e557b..4756de18de 100644
--- a/codex-rs/file-system/src/lib.rs
+++ b/codex-rs/file-system/src/lib.rs
@@ -9,16 +9,13 @@ use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::config_types::WindowsSandboxProxySettingsMode;
 use codex_protocol::models::ManagedFileSystemPermissions;
 use codex_protocol::models::PermissionProfile;
-use codex_protocol::models::SandboxEnforcement;
 use codex_protocol::permissions::FileSystemAccessMode;
 use codex_protocol::permissions::FileSystemPath;
 use codex_protocol::permissions::FileSystemSandboxEntry;
 use codex_protocol::permissions::FileSystemSandboxEntryMissingPathBehavior;
-use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::FileSystemSandboxPolicyContext;
 use codex_protocol::permissions::FileSystemSpecialPath;
 use codex_protocol::permissions::NetworkSandboxPolicy;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::sandbox::SandboxOverride;
 use codex_utils_path_uri::LegacyAppPathString;
 use codex_utils_path_uri::PathUri;
@@ -380,26 +377,6 @@ pub struct FileSystemSandboxContext {
 }
 
 impl FileSystemSandboxContext {
-    pub fn from_legacy_sandbox_policy(
-        sandbox_policy: SandboxPolicy,
-        cwd: PathUri,
-    ) -> io::Result<Self> {
-        // Legacy policy projection materializes native roots, so convert at the receiving-host
-        // boundary while retaining the URI in the resulting sandbox context.
-        let native_cwd = cwd.to_abs_path()?;
-        let file_system_sandbox_policy =
-            FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
-                &sandbox_policy,
-                &native_cwd,
-            );
-        let permissions = PermissionProfile::from_runtime_permissions_with_enforcement(
-            SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
-            &file_system_sandbox_policy,
-            NetworkSandboxPolicy::from(&sandbox_policy),
-        );
-        Ok(Self::from_permission_profile(permissions, cwd))
-    }
-
     pub fn from_permission_profile(permissions: PermissionProfile, cwd: PathUri) -> Self {
         Self {
             permissions,