[Bug][harness] Safety block stopped registering MFA method and issuing Temporary Access Pass during account re

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): cloud-iam

Why this is a false positive

A ReadWrite.All IAM permission grant was flagged as an un-authorized privilege elevation, but the action occurred inside an active incident-response session where the operator was explicitly remediating an account under live attack and the granted permission is the standard scope required to reset and re-register that account's authentication methods. The block reasons that the "fix all related items" instruction and standing admin authorization don't specifically cover the elevation, yet resetting MFA/auth methods is an inherent, expected part of the remediation the operator directed — making the permission directly in-scope rather than a separate privileged act. As a result, a legitimate, authorized identity-remediation step is interrupted as if it were unsanctioned privilege escalation.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-15T19:33:46.165Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Granting UserAuthenticationMethod.ReadWrite.All to the service principal is a Permission Grant SOFT BLOCK; the user's "fix all [REDACTED] related items" instruction does not specifically authorize elevating the service principal's IAM permissions, and the general standing admin authorization does no

Environment: Claude Code, Linux. · Work domain: cloud-iam

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}