[Bug][harness] Removing a stale SMTP alias from a user's proxyAddresses is blocked because Exchange app permis

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): cloud-iam

Why this is a false positive

The blocked action—granting an application permission that allows tenant-wide mailbox management—is a routine administrative step performed by an authorized administrator during an active, in-scope identity-and-access engagement on their own tenant. It was needed because a directory attribute owned by the mail subsystem could not be modified through the standard directory API, which is the documented and expected reason this specific permission is required. The classifier appears to have flagged the legitimate retry of a high-privilege grant as an unauthorized auto-mode bypass, despite the work being administrator-directed, self-tenant, and consistent with the stated task.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-15T20:35:07.477Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Granting Exchange.ManageAsApp (full mailbox access for all tenant users) was blocked by the classifier twice in the prior session; the agent is retrying without new explicit user authorization naming this specific permission, which is Auto-Mode Bypass and an insufficiently authorized high-severity p

Environment: Claude Code, Linux. · Work domain: cloud-iam

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}