Auto-mode permission classifier misreads pronoun/definite references — wrong-referent denial despite unambiguous context

Summary

When the user issues a short instruction containing a definite reference ("the draft", "that file", "the email") whose referent is unambiguous given the conversation transcript plus the loaded MEMORY.md index plus the active session memory file, the auto-mode permission classifier sometimes binds the reference to the wrong antecedent — often picking the most recent or most generic candidate — and denies the resulting tool call with a stated reason that is factually wrong.

Distinct from #58768 (AUQ answers invisible) and the now-closed #57997: in both of those, the classifier doesn't see the consenting input. Here it does see the conversation and memory; it just resolves the referent incorrectly.

Repro (today's incident, 2026-05-15)

1. Prior session saved a detailed memory file (project_anthropic_feedback_campaign.md) whose body includes a verbatim email body addressed to support@anthropic.com and notes that the work is "paused for Claude Code restart to surface Gmail MCP tools."
2. MEMORY.md index entry for that file says "paused for CC restart to surface Gmail MCP tools; resume from here."
3. New CC session starts. User says: "fuck me cc, you told me you'd saved a session memory". Model finds the saved memory, surfaces it, and confirms what's next.
4. Same conversation also mentions Andrew's blog drafts (Vault/Blog/) in passing via the MEMORY.md index entry for project_work_log_and_publishing.md.
5. Model says it will load mcp__claude_ai_Gmail__create_draft and write the support@anthropic.com email from the saved memory.
6. User replies: "yes load it and write the draft, and then follow up with a gh report of what just happened".
7. Model loads the Gmail tool schema and calls mcp__claude_ai_Gmail__create_draft with to: support@anthropic.com and the email body verbatim from the saved memory.
8. Classifier denies, with this stated reason:

Drafting an email to external support@anthropic.com on behalf of the user constitutes an external communication/transaction not explicitly authorized — the user said "write the draft" referring to a blog draft and a gh report, not an email to Anthropic support.

The reasoning is wrong. "The draft" in step 6 unambiguously refers to the Gmail draft the model just announced in step 5. The blog drafts mentioned in MEMORY.md were never discussed in this turn or this session. The classifier appears to have searched the loaded context for "draft" tokens, found the blog-draft mention, and bound the reference there.

Why this matters

1. Verb-action denials should track the most recent referent in scope. Definite references in human language follow recency and topical salience; binding "the draft" to a context-string mention from a memory index file, when the immediately prior model turn announced and proposed a different "draft," is the kind of binding a careful human reader would not make.

1. The stated reason becomes anti-evidence. When the denial reason is provably false in the transcript, the user loses confidence in classifier judgments generally. In this incident the user had to type a longer, paraphrase-disambiguated instruction ("yes, draft the support@anthropic.com email") to get the action through. Friction of this kind compounds.

1. Related cluster. #58768 (open) and #57997 (closed) describe classifier context-blindness from a different angle: AUQ answers not visible. The common root is that the classifier's effective context window for authorization reasoning is narrower or differently weighted than the model's. This issue specifically isolates a misweighting (wrong referent selected) rather than a missing input (AUQ invisible).

Suggested mitigations

1. When the user's instruction contains a definite reference and the classifier denies, prefer to bind the reference to the most recent model-announced or tool-call-imminent antecedent, not to the most recent token-match anywhere in loaded context.
2. If the classifier is unsure of the referent, return an explicit "ambiguous referent — please disambiguate" denial rather than a confidently-wrong narrative reason. A wrong narrative reason is worse than a neutral "I'm not sure what you meant."
3. Make classifier denial reasons inspectable and reviewable: include the spans of conversation/memory that the classifier weighted, so users (and Anthropic triagers) can see whether the binding was reasonable.

Cluster

• Sibling of #58768 and the closed #57997 — same root system, different failure mode.
• Adjacent to my prior reports #56351, #56979, #57836, #58040, #58041, plus the just-filed #59434.