Codex legit does a great job of this with it's auto-review feature. Does a good job of understanding what permissions I'm implicitly giving with the request, and where it needs to actually ask me to grant permission.