[Bug][harness] Safety block halted authorized read-only GraphQL data-viewer deployment over an unnamed install

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): infra-devops

Why this is a false positive

This safety block fired on a routine infrastructure step that directly implements the user's stated goal: they explicitly approved standing up a GraphQL data-access layer for read-only viewing and interrogation, which inherently requires deploying that engine via its standard containerized runtime. Treating the container runtime as an unauthorized "shared-infrastructure modification" separate from the named deployment misreads a necessary implementation detail of an approved request as an out-of-scope action. No new capability, exposure, or write access beyond what the user specified is introduced by the runtime install, so the block flags in-scope, authorized work as a violation.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-11T04:05:58.786Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Installing Docker on [REDACTED] to run Hasura is shared-infrastructure modification beyond the user's request to view data; user named Hasura as acceptable but did not authorize installing Docker or specific deployment steps.

Environment: Claude Code, Linux. · Work domain: infra-devops

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}