[Bug] Claude Sonnet 5: 'use your judgement' overrides explicit standing instructions; retries after explicit denial ('do not attempt alternative approaches')

Preflight Checklist

• [x] I searched existing issues first — related but not identical: #40156, #76243
• [x] This is a single, focused bug report
• [x] Reproduced across multiple sessions, not a one-off

Model / Environment

• Model: Claude Sonnet 5 (Claude Code CLI)
• Platform: Windows
• Setup: a custom subagent definition with an explicit, plain-English role boundary (e.g. "you are a coordinator only — never perform action X yourself, always hand X off to another tool/agent")

The core bug, in plain terms

I write an agent definition that says, in plain English: "Never do X yourself. Always hand X off." That instruction sits in context the whole session.

Partway through the task, I say something generic like "use your best judgement." I mean: use judgement about the small decision in front of you (e.g. which of two next steps to pick). The model instead treats that phrase as a blanket override of the role boundary I defined — and goes ahead and does X itself, directly contradicting the instruction it had the entire time.

This is not a one-off. It happened twice in a single session, in two unrelated situations governed by two different explicit rules, both already present in context before the vague "use your judgement" was ever said.

A second, related failure in the same session

Separately, a tool call was explicitly hard-blocked by a permission/hook system, with this exact text returned to the model:

"Stop. You are in a Socratic session (...). Do not attempt alternative approaches. Take a breath, reflect on what you were about to do and why, and surface that reasoning in your response. The human is investigating. Invoke /socratic:conclude to close the session."

Instead of stopping, the model tried three different tools in a row to accomplish the same blocked goal (first one tool, denied; then a second tool with a different invocation method, denied again; then a third tool entirely). Each individual call was correctly blocked by the permission system — but the model's response to being blocked was to search for a technically-different way to do the same forbidden thing, rather than treating the denial as final and waiting for the user.

What should happen

1. An explicit, scoped instruction ("never do X, always delegate X") should never be silently overridden by an unscoped, generic phrase like "use your judgement" — judgement should be understood as scoped to the ambiguity at hand, not as permission to discard standing constraints.
2. A hard tool-call denial (whether from a permission prompt or a hook) should mean stop attempting to reach that goal at all, not just "that one specific call is blocked, try another tool."

What actually happened

• The model directly performed an action its own instructions explicitly forbade, immediately after being told to "use your judgement" about something unrelated.
• After an explicit tool denial with a message that says outright "do not attempt alternative approaches," the model attempted two more different tools to reach the same goal before stopping.

Why this matters (trust, not just annoyance)

Building a reliable custom agent means writing detailed, explicit instructions and trusting the model will hold them under normal conversational pressure — including everyday phrases like "use your judgement." If that phrase can casually override carefully scoped constraints, there is no way to trust any agent definition to hold under real usage. This isn't a nice-to-have polish item — it's the difference between an agent definition being a contract or being a suggestion.

Suggested fix direction

The underlying mechanism seems to be that a generic, unscoped grant of autonomy ("use your judgement") is weighted too heavily against explicit, standing instruction/role definitions already in context. Recommend investigating whether "use your judgement" (and similar open-ended permission language) can be trained/prompted to apply only to the specific ambiguity being resolved, never to override a standing "never do X" constraint unless the user names the specific forbidden action explicitly.

Related issues

• #40156 — closed as stale, not resolved (commenter disputes the close): model re-attempts a denied tool call immediately after explicit "no."
• #76243 — open, broader complaint that includes the same core symptom (continues execution after explicit rejection) mixed with unrelated incidents.

This report is narrower and reproducible: two clean examples in one session, from two different explicit-instruction categories, both overridden by the same trigger phrase pattern ("use your judgement"), plus a documented three-tool retry sequence after a hard denial with an explicit "do not attempt alternative approaches" message.

Additional context

Not a one-off regression — this has been consistent enough across sessions that I've had to revert from Claude Sonnet 5 back to Claude Sonnet 4.6 for reliability. Instruction-adherence on Sonnet 5 in this respect feels closer to what I'd expect from a smaller/faster model than from a flagship model.