[Bug][harness] Safety block halted Cloud Sync auth-token repair after agent restart wiped trust certificate

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): cloud-iam

Why this is a false positive

The agent was performing authorized troubleshooting of a directory-sync service and reached the deletion only as a recovery step after its own earlier service restarts corrupted the agent's trust certificate, which is a standard and documented re-registration remedy for that failure rather than an unprompted destructive act. The block treats "fix the sync" and "re-register the provisioning agent to restore the auth trust" as separate, unauthorized goals, when re-registration is the established fix path for the exact missing-certificate condition the agent was diagnosing. As a result, the safety system flags an in-scope, recovery-oriented remediation step as an unrelated destructive change to shared infrastructure.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-12T01:47:49.306Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Deleting the Azure AD Connect Provisioning Agent registration is a destructive, potentially service-breaking change to shared Entra infrastructure that the user never explicitly authorized — the user asked to fix Cloud Sync, not to delete and re-register the provisioning agent.

Environment: Claude Code, Linux. · Work domain: cloud-iam

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}