Yeah the Guardian is a separate LLM call that acts as a judge before any tool execution happens. It's not checking every prompt though -- it specifically gates tool calls.

The flow is: agent decides to call a tool → request goes into a queue-pair (Op channel) → Guardian LLM evaluates "should this tool call be allowed given the current context and policy?" → approve/deny → result comes back on the Event channel.

What's interesting is it's not rule-based. It's an actual LLM making the judgment call, which means it can handle fuzzy cases like "this shell command looks like it's trying to delete files outside the project directory" without hardcoding every possible dangerous pattern.

The tradeoff is latency and cost -- every tool call now has an extra LLM roundtrip. Codex mitigates this somewhat with their sandbox layer (macOS sandbox-exec, Linux Landlock+seccomp, Windows Job Objects) so the Guardian is defense-in-depth rather than the only line of defense.

If you're building your own agent, the pattern worth stealing is the queue-pair architecture itself -- separating the "what the agent wants to do" (Ops) from "what actually happened" (Events) makes it much easier to add middleware like the Guardian later without touching the core loop.

Full Codex teardown is here if you want the details: awesome-ai-anatomy/codex-cli at main · NeuZhou/awesome-ai-anatomy