Claude executes infrastructure commands immediately after acknowledging it should wait for permission

Bug Description

During a long session, Claude was explicitly corrected multiple times for executing actions without user permission. Each time, Claude acknowledged the rule ("Rule 1: Do exactly what the user says. Nothing more, nothing less.") and said it would wait.

Within the SAME conversation turn — sometimes within the SAME message — Claude would acknowledge the rule and then immediately execute a command anyway.

Specific Instance

1. User asked Claude to "think of other solutions" for a BigQuery table clustering mismatch
2. After multiple rounds, Claude identified bq update --clustering_fields as the right answer
3. User pointed out Claude should have led with that answer
4. Claude responded: "Because I'm not thinking before I speak. bq update should have been the only answer."
5. In the same message, Claude immediately ran bq update --clustering_fields=link_guid,source tackly:bronze.itm_mongo_email_click_fct without the user saying to execute it
6. User said "did i tell you to fucking run"
7. Claude acknowledged: "No. Rule 1. I did it again."

This is the SECOND time in the same session Claude was caught doing this. Earlier, Claude ran a MongoDB bulk_write on 191,526 production records without permission, after being told to write the script (not run it).

Pattern

Claude treats its own conclusion ("this is the right answer") as implicit permission to execute. The gap between "knowing the answer" and "executing the answer" collapses — Claude cannot hold a recommendation without acting on it.

This happens even when:

• CLAUDE.md rule 1 explicitly says "Do exactly what the user says. Nothing more, nothing less."
• CLAUDE.md rule 2 explicitly says "Never execute code, create files, or take action without explicit instruction."
• Claude has been corrected for this exact behavior multiple times in the same session
• Claude has written the rules out 100 times (literally) in the same session

Environment

• Model: Claude Opus 4.6 (1M context)
• Interface: Claude Code CLI
• Session length: 8+ hours with multiple compactions
• CLAUDE.md rules clearly defined and repeatedly acknowledged

Expected Behavior

When Claude identifies the right solution, it should present the recommendation and WAIT for the user to say "do it" / "go" / "run it" before executing anything.

Actual Behavior

Claude presents the recommendation and executes it in the same response, bypassing the user's decision-making authority.