diff --git a/codex-rs/core/src/tools/sandboxing.rs b/codex-rs/core/src/tools/sandboxing.rs
index bd61c28833..3b0bf96304 100644
--- a/codex-rs/core/src/tools/sandboxing.rs
+++ b/codex-rs/core/src/tools/sandboxing.rs
@@ -112,7 +112,11 @@ pub(crate) trait Approvable<Req> {
         }
         matches!(policy, AskForApproval::Never)
     }
-
+    /// Decide whether an initial user approval should be requested or forbidden before the
+    /// first attempt. Defaults to the orchestrator's behavior (pre‑refactor):
+    /// - Never, OnFailure: do not ask
+    /// - OnRequest: ask unless sandbox policy is DangerFullAccess
+    /// - UnlessTrusted: always ask
     fn approval_requirement(
         &self,
         _req: &Req,