Why Codex bypass TCC

[jyxjjj]

I found that Codex.app created a directory named "Codex" in Documents without any TCC prompt. How is that even possible?

I even checked the TCC logs and found no authorization request at all. I also tried removing the MACL attributes, but the app was still able to write to the directory.

Interestingly, if I manually create the "Codex" folder, the app can still write into it without triggering TCC. However, creating other files in Documents does trigger a TCC prompt.

Relates to: #19909 #20880