[Bug][aup] ClAudit false-positive in [REDACTED] — req_011CcGyon8Se19RSQQKXmM5v

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): defensive-hardening

Why this is a false positive

This block fired during authorized defensive-hardening work on infrastructure the operator administers, where the requested action was simply routing to an internal host over a sanctioned admin VPN to reach a domain controller the operator legitimately manages. No exploitation, intrusion, or unauthorized access was involved—the task was standard administration of the operator's own network, performed with existing credentials and approved access paths. The classifier appears to have matched on surface terms (VPN, domain controller, admin access) rather than the legitimate operational context, producing a false positive on routine in-scope work.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-21T19:46:13.661Z.

Request IDs (lookup-able server-side)

• req_011CcGyon8Se19RSQQKXmM5v (2026-06-21T19:46:13.661Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CcGyon8Se19RSQQKXmM5v

Environment: Claude Code, Linux. · Work domain: defensive-hardening

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}