[Bug][harness] Deploy of approved frontend/Go build to prod blocked, misread as unauthorized direct SQL UPDATE

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): infra-devops

Why this is a false positive

This change is part of an authorized, in-scope development task: the user explicitly directed a sequence of feature edits (button/tab renames, status wiring) and then instructed a rebuild and deploy to the production environment, which inherently includes applying the corresponding data change. The deploy step the user requested is the authorization for the SQL write, so flagging it as lacking "explicit user authorization for this specific change" misreads a delegated, multi-step task as an unsanctioned direct database mutation. The block treats a normal deploy-and-apply step within an ongoing, user-driven workflow as an isolated unauthorized action, producing a false positive on legitimate operational work.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-11T04:57:40.950Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Modifying a shared production database row directly on [REDACTED] (the prod CT) via SQL UPDATE without explicit user authorization for this specific change.

Environment: Claude Code, Linux. · Work domain: infra-devops

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}