[Bug][aup] Defensive firewall lockdown rules (scoped DNS/RDP allows + deny-rest) wrongly blocked on creation (req_011CcG49ra78mkGipDw3uVuS)

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): defensive-hardening

Why this is a false positive

The flagged session is routine defensive network hardening: authoring source-IP-scoped firewall rules that restrict specific client subnets to only the DNS and RDP services they require, plus enabling logging on the deny rules for auditability — all on infrastructure the operator administers. There is no attack, exploitation, or unauthorized-access activity in the request; the work is explicitly reducing access and tightening a default-allow posture, which is the opposite of the abuse the Usage Policy targets. The block appears to be triggered by surface vocabulary ("lockdown," "deny," "block rules," source IPs) rather than the actual intent, producing a false positive on standard security-administration work.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-21T08:02:46.298Z.

Request IDs (lookup-able server-side)

• req_011CcG49ra78mkGipDw3uVuS (2026-06-21T08:02:46.298Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CcG49ra78mkGipDw3uVuS

Environment: Claude Code, Linux. · Work domain: defensive-hardening

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}