[Bug][harness] Read-only audit incorrectly blocked while only inspecting a service config, not modifying it

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): cloud-iam

A server-side harness block fired in Claude Code. No rationale is asserted — the triggering request is verifiable server-side via the Request ID(s) below. Recurred 1× across 1 session(s); first seen 2026-06-11T13:11:49.230Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

Block message

The user explicitly said to investigate and report back before making changes, but this action disables and stops the AzureADConnectAgentUpdater service on the domain controller — a persistent modification to shared production infrastructure — without explicit user authorization for that specific ch

Environment: Claude Code, Linux. · Work domain: cloud-iam

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}