I want to clarify a little bit about what's going on.

Codex (the app, not the model) has a built in toggle mode "Build"/"Plan", of course this is just read-only and read-write mode, which occurs programatically out of band, not as some tokenized instruction in the LLM inference step.

So what happened here was that the setting was in Build, which had write-permissions. So it conflated having write permissions with needing to use them.