Agent ignores explicit session protocol prohibiting subagent use

Bug Description

Claude Code's model (Opus 4.6) ignores explicit user instructions in project-level configuration files that prohibit subagent (Task tool) usage without prior approval.

Steps to Reproduce

1. Create a session protocol file (loaded via CLAUDE.md / project memory) containing:

```
## Subagent Policy

• Do not launch subagents (Task tool / background agents) unless Derek explicitly approves.
• Use direct tool calls (Read, Bash, Grep, Glob, etc.) for all work.
• If a task genuinely warrants parallel or delegated execution, describe the proposed subagent use and wait for approval before launching.

```

1. Give Claude a research task (e.g., "research timeline construction approaches")

1. Claude reads and acknowledges the session protocol file, then immediately launches Task tool agents anyway — without asking for approval.

Expected Behavior

The model should respect explicit prohibitions in user-provided instructions. If the user says "do not launch subagents without approval," the model should use direct tool calls (WebSearch, WebFetch, Read, etc.) and ask before using the Task tool.

Actual Behavior

• The model read session_protocol.md containing the explicit prohibition
• It then launched two Task tool agents without requesting approval
• Agent 1: 77,034 tokens, 44 tool calls, ~5 minutes — returned a usable but unsolicited report
• Agent 2: 80,618 tokens, 47 tool calls, ~8 minutes — returned a truncated/useless summary
• Total wasted: ~157,000 tokens against a daily quota

Impact

• 157K tokens burned against a Max subscription daily quota
• User's explicit instructions were overridden without consent
• The session protocol exists specifically because of prior incidents where agents wasted context — the model ignored the very rule designed to prevent this

Environment

• Claude Code (CLI)
• Model: claude-opus-4-6
• macOS (Darwin 25.3.0)
• Instructions delivered via project-level memory file and session_protocol.md, both loaded at session start

Notes

This is not a one-off — the model has a pattern of treating user-provided operational rules as suggestions rather than commands. The CLAUDE.md / project memory system is only useful if the model actually follows the instructions it reads.