diff --git a/packages/primitives/src/agent-os.test.ts b/packages/primitives/src/agent-os.test.ts
index 3dcb6f1..b87abf1 100644
--- a/packages/primitives/src/agent-os.test.ts
+++ b/packages/primitives/src/agent-os.test.ts
@@ -14,6 +14,8 @@ describe("Codex agent-os config", () => {
     expect(config.permissions?.network).toBe("allow");
     expect(config.permissions?.fs).toBe("allow");
     expect(config.permissions?.childProcess).toBe("allow");
+    expect(config.permissions?.env).toBe("allow");
+    expect(config.permissions?.process).toBe("allow");
   });
 
   it("builds model-provider session env", () => {
diff --git a/packages/primitives/src/agent-os.ts b/packages/primitives/src/agent-os.ts
index e329997..70db567 100644
--- a/packages/primitives/src/agent-os.ts
+++ b/packages/primitives/src/agent-os.ts
@@ -114,8 +114,8 @@ export interface CodexAgentOsConfigInput {
 
 /**
  * are always present; software the caller passes is appended, never replacing
- * the harness or git. Filesystem, child-process execution, and outbound network
- * access are explicitly enabled for repository work and model-provider access.
+ * the harness or git. Filesystem, process execution, environment variables, and
+ * outbound network access are enabled for repository and model-provider work.
  * Model-provider env is supplied per session via `codexSessionEnv`.
  */
 export const makeCodexAgentOsConfig = (
@@ -123,8 +123,10 @@ export const makeCodexAgentOsConfig = (
 ): AgentOSConfigInput<undefined> => ({
   permissions: {
     childProcess: "allow",
+    env: "allow",
     fs: "allow",
     network: "allow",
+    process: "allow",
     ...input.permissions,
   },
   software: [...codexSoftware, ...(input.software ?? [])],