diff --git a/packages/primitives/src/agent-os.test.ts b/packages/primitives/src/agent-os.test.ts
index 5e0c996..755f6c0 100644
--- a/packages/primitives/src/agent-os.test.ts
+++ b/packages/primitives/src/agent-os.test.ts
@@ -12,6 +12,7 @@ describe("Codex agent-os config", () => {
   it("allows outbound VM networking", () => {
     const config = makeCodexAgentOsConfig();
     expect(config.permissions?.network).toBe("allow");
+    expect(config.permissions?.fs).toBe("allow");
   });
 
   it("builds model-provider session env", () => {
diff --git a/packages/primitives/src/agent-os.ts b/packages/primitives/src/agent-os.ts
index 163abe6..fcc67fe 100644
--- a/packages/primitives/src/agent-os.ts
+++ b/packages/primitives/src/agent-os.ts
@@ -108,20 +108,21 @@ export const codexSessionEnv = (
 export interface CodexAgentOsConfigInput {
   /** Extra software merged after the Codex+git bundle. */
   readonly software?: NonNullable<AgentOSConfigInput<undefined>["software"]>;
-  /** VM permission overrides merged over the default network-enabled policy. */
+  /** VM permission overrides merged over the execution policy. */
   readonly permissions?: AgentOSConfigInput<undefined>["permissions"];
 }
 
 /**
  * are always present; software the caller passes is appended, never replacing
- * the harness or git. Outbound networking is explicitly enabled for repository
- * and model-provider access. Model-provider env is supplied per session via
- * `codexSessionEnv`, not here — the actor config has no env field.
+ * the harness or git. Filesystem and outbound networking are explicitly enabled
+ * for repository work and model-provider access. Model-provider env is supplied
+ * per session via `codexSessionEnv`, not here — the actor config has no env field.
  */
 export const makeCodexAgentOsConfig = (
   input: CodexAgentOsConfigInput = {}
 ): AgentOSConfigInput<undefined> => ({
   permissions: {
+    fs: "allow",
     network: "allow",
     ...input.permissions,
   },