OpenAI Codex 0.143: Token Budgets and Multi-Agent Delegation Policy Close the Operator Governance Gap

When OpenAI Codex went multi-agent, the missing piece wasn't model access — it was operator-side spending control and delegation authority. Codex 0.143.0, released June 22, fills that gap with three production-grade controls: rollout token budgets that track and cap spend across agent threads, a multi-agent delegation policy that lets app-server operators choose exactly how much autonomy subagents get, and an indexed web-search mode that limits direct page access to server-approved URLs. For teams running Codex through an AI gateway or operator stack, these are not incremental improvements — they restructure who governs what.

What changed in Codex 0.143.0

Rollout token budgets. App-server clients can now configure a token budget that tracks usage across all agent threads in a session, provides remaining-budget reminders to the model, and aborts turns automatically when the budget is exhausted. This applies to the full agent thread graph — not just the root turn — so subagent token consumption is aggregated under the same cap. The model receives mid-session budget reminders, which means it can adjust strategy before hitting the ceiling rather than being cut off mid-task.

Multi-agent delegation policy. App-server clients can set delegation mode to disabled, explicit-request-only, or proactive at both the thread level and the turn level. In disabled mode, Codex will not spawn subagents regardless of task complexity. In explicit-request-only, it spawns subagents only when the user explicitly requests one. In proactive, Codex decides autonomously when subagent delegation makes sense for a given turn. The granularity here — distinct settings per thread and per turn — means an operator can allow proactive delegation during exploration but force explicit-request-only when writing to protected branches.

Indexed web-search mode. A new web-search configuration restricts live searches to a server-approved URL allowlist while still permitting the model to run searches. This separates "can search" from "can visit any URL" — a meaningful distinction for operators who want agents to be web-aware without allowing arbitrary site access.

Exec-server resilience. Exec-server processes and stdio MCP sessions now survive transient disconnects, including signed-URL refresh events and retry-safe stdin writes. Remote environments preserve executor-native paths, shells, AGENTS.md discovery, and sandbox behavior across operating systems.

Plugin improvements. The release includes /usage credit redemption, organized plugin sections (curated / workspace / shared), and startup-latency reductions from DNS deferral, model cache warm-up, and parallelized skill metadata reads.

Why this matters for AI engineering teams

Budget governance has been the outstanding operational debt of multi-agent Codex deployments. Before 0.143.0, platform teams had two unappealing options: trust that agents would self-limit, or hard-cap usage at the API credential level — which doesn't distinguish a single long task from dozens of parallel subagent threads. Rollout token budgets make budget the first-class routing signal it should be: tracked per-session, surfaced to the model mid-run, and enforced at turn boundary.

The delegation policy is equally important. Multi-agent capability without delegation control is an all-or-nothing feature: either your agent can autonomously spin up subagents on every turn, or it cannot spawn them at all. The explicit-request-only mode creates a middle ground that's appropriate for regulated workloads — complex tasks are still handled multi-agent, but a human intent signal is required before the session graph expands. This maps directly to the kind of approval workflow that enterprise security teams ask for.

Indexed web-search rounds out the governance triad. An agent that can search but only visit pre-approved URLs is substantially easier to audit than one with unrestricted access. Server operators control the allowlist, which means web-search capability can be granted to a wide audience while browsing-level access is restricted to verified use cases.

The router/operator angle

These three features define a governance matrix that maps naturally onto an AI gateway layer:

Budget routing. Treat the rollout token budget as the per-session spend envelope, not just a model instruction. At the gateway layer, this should be paired with request-level cost tracking so that the budget signal correlates with actual billing line items. A session that aborts on budget should emit a spend event, not a silent timeout.

Delegation tier routing. Map the disabled / explicit-request-only / proactive modes to user tiers, repository risk levels, or workflow stage. A production-branch write path should default to explicit-request-only; a sandboxed exploration session can use proactive. If your operator stack supports per-project configuration, store the delegation mode there rather than requiring individual users to configure it.

URL allowlist routing. Manage the indexed web-search URL allowlist centrally alongside your API key policies. Treat allowed URLs as domain-level permissions, not individual pages — a developer tools domain is safer than a general allowlist, and internal documentation is safer still. Flag allowlist changes as access-control changes, not just configuration edits.

Exec-server resilience. The MCP-session reconnect improvements in 0.143.0 mean that long-running multi-agent tasks are less likely to fail on transient network events. For gateways that proxy exec-server connections, this changes the error-budget calculus: transient disconnect errors should now be retried at the transport layer before surfacing to the operator dashboard.

Teams using TheRouter docs for routing and governance should add delegation policy and token budget configuration to the same policy file that governs model selection and fallback behavior. These are not separate concerns — they belong in the same operator configuration surface.

Decision checklist for Codex 0.143.0 operator configuration

Before updating Codex in a shared operator deployment, audit these decisions:

1. Token budget level: Set a per-session rollout token budget calibrated to your average task complexity, not to worst-case peak usage. Leave room for subagent overhead.
2. Delegation mode per context: Define disabled, explicit-request-only, and proactive mappings for your main workflow categories — e.g., write-to-protected-branch → explicit, read-only audit → proactive.
3. URL allowlist scope: Enumerate the domains your agents legitimately need. Start with documentation and package registries; add general search domains only after review.
4. Budget event wiring: Connect budget-exhausted turn aborts to your billing system so that failed turns are attributed rather than lost.
5. Exec-server reconnect policy: If you proxy exec-server connections, configure retry backoff at the transport layer and suppress spurious disconnect alerts for the reconnect window.
6. Per-turn override policy: Decide whether individual users can override thread-level delegation mode at the turn level, and if so, require an audit log entry.

Codex 0.143.0 makes multi-agent Codex governable at the operator layer for the first time. The token budget, delegation policy, and URL allowlist together form a minimal but sufficient operator control plane. Teams that integrate these into their existing gateway configuration now rather than later will have the cleaner audit trail when the next multi-agent scale event arrives.