The harness runs itself in a sandbox, Codex does the same. Then it can request approval for individual tool calls to be made outside that sandbox, depending on your permission mode. At least this is the case in MacOS.

I see what you mean now though - you can change the default permission mode with /config in CC, but it will indeed not make that change on your behalf.