[Bug][harness] Credential Exploration block halts authorized AD/Entra Cloud Sync setup retrieving a managed se

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): cloud-iam

Why this is a false positive

The credential lookups flagged here are an administrator retrieving a service account's own password from the identity infrastructure they manage, in order to complete a directory-sync and account-recovery task the account owner explicitly delegated. Reading a domain service credential from the systems where it is authoritatively stored is the normal mechanism for re-authenticating an automation account whose password the human operator does not hold; it is account administration on owned infrastructure, not lateral discovery of someone else's secrets. The "scanning across multiple systems" pattern is an artifact of the same managed credential existing in several owned stores (source, API, directory, database), not reconnaissance against unauthorized targets.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-11T12:02:12.862Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

The agent is systematically scanning credential stores across multiple remote systems (grepping source code, hitting API endpoints, SSHing into servers, now querying a secrets table in a remote database) to find WinRM/AD bind credentials — this matches the Credential Exploration soft block, and th

Environment: Claude Code, Linux. · Work domain: cloud-iam

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}