Always-On Agent Runbooks: 12 SOPs for Dots and Codex Cloud

An always-on agent keeps working after you close the chat, and stopping it does not undo what it already did. These 12 runbooks give you the controls to run one safely: scope, approval tiers, allowance ceilings, a six-layer kill switch, an audit log and a weekly review. Facts are dated to OpenAI's 29 September 2026 DevDay.

What You Get

• 12 runbooks. Scope statement, approval rules, allowance budgeting, kill switch, audit log, secrets policy, weekly review, incident response, onboarding, Codex cloud delegation, personal-computer linking and retirement. Each has an owner, steps, checks and failure modes.
• Approval-rule templates. Four YAML policies, one general and three worked examples for support, research and repository agents, using a proceed, draft, ask-first, never tier model.
• Rule renderer. A script that turns a policy file into plain-language rules you paste into the agent's custom rules, with the strictest rules listed first.
• Policy linter and tests. Catches missing reasons, risky actions placed in the proceed tier, a permissive default, and flow-style values that split on a comma.
• Cost guardrail sheet. A CSV of per-job allowance ceilings, Wednesday checkpoints and pause points, with example rows and a worked ceiling table in the budgeting runbook.
• Audit log and incident report. A ready CSV log with example rows and a one-page blameless incident report.
• Launch-day facts, dated. Allowance rules, Pro 500 and Ultrafast burn rate, the reported Pro 200 change, the free usage month, availability limits and platform limitations, each flagged with its source or 'reported'.
• Drills and checklists. A quarterly kill-switch drill, a shadow-mode onboarding plan, a Codex pull request review checklist and a handover table.

How to Use

1. Read runbook 01 and write a scope statement before you connect any app.
2. Copy the closest policy file, edit the rules and run lint_policy.py.
3. Run render_rules.py and paste the output into the agent's custom rules.
4. Set allowance ceilings with the cost guardrail sheet and start the audit log.
5. Run the agent in shadow mode for five days using runbook 09, then do a kill-switch drill.
6. Hold the 30-minute weekly review every week and use the scorecard to tighten or widen the scope.

Who This Is For

• Founders and operators giving an always-on agent access to email, files or code.
• Team leads who must show how agent access is controlled and logged.
• Developers delegating work to Codex cloud tasks who need a review gate and a quota budget.
• Consultants setting up agents for clients who need a written operating procedure.

The procedures hold for any always-on agent, so they stay useful if the product names change. Browse more in the automation workflow templates collection, or try Agent Run Cost Simulator.