I blame the hidden context on the tools/subagents. One recent example.. codex can just look in the code for Db schema but continually tries to request permission for a live db query