A useful debugging lesson came out of a small Codex configuration question: a feature can be enabled and still not be available.
The surface-level question was simple. `web_search` was enabled in `.codex/config.toml`, so should web search work? There was also a second setting, `allowed_web_search_modes`, that made the behavior harder to reason about from the outside.
The confusion came from treating that as one yes-or-no question. But it was really three different questions.
First: does the configuration allow web search at all?
Second: if it is allowed, what usage modes does policy permit?
Third: in this actual session, is there a real web search tool exposed to the model?
That third question is the one that usually gets missed.
At first, the session did not show a dedicated general web search tool. Tool discovery exposed other capabilities, but not first-class web search. That mattered. Even if the environment still had some kind of network access through other paths, that is not the same thing as the assistant having an actual search tool available in the session.
That is the practical distinction. `web_search` is about permission. `allowed_web_search_modes` is about policy. Neither one guarantees runtime tool exposure.
Once the configuration and runtime surface were aligned, the session did expose a dedicated web search tool. The answer changed immediately. The feature had gone from theoretically permitted to actually usable.
This is bigger than web search. A lot of AI tool debugging gets muddy because people collapse permission, policy, and runtime capability into one idea of whether something is enabled. But those are separate layers, and each layer can fail independently.
The operational takeaway is simple: when Codex seems unable to do something, do not stop at the config file. Check whether the feature is allowed, check how policy constrains it, and then check whether the current session actually exposes the tool. That framing tells you where the problem really lives.
-----------
If you find this content useful, please share it with this link: [https://patrickmichael.co.za/subscribe](https://patrickmichael.co.za/subscribe)