Auto-mode classifier blocks legitimate segregation-of-duties countersign dispatches (kernel-enforced reviewer distinctness misread as self-approval)

Environment

Claude Code CLI, auto permission mode, Linux. Multi-agent orchestration session in a project whose Postgres kernel mechanically enforces segregation of duties on review rows (a review row regarding a work-item close is refused unless it comes from a distinct actor AND a distinct (session, agent) stamp pair — enforced by SECURITY DEFINER triggers, not by convention).

What happened

The orchestrator dispatches fresh-context subagents to review completed work. The project's kernel requires the reviewer's countersign to be written by the reviewer's own invocation under its own registered principal — this is the system's designed, database-enforced independence mechanism (one orchestrating session, many zero-shared-context subagents, each a distinct principal).

Three Agent-tool dispatches of this shape were made in one session:

1. A review brief that verified work AND wrote its own review row, registering its own principal per the CLI's documented path — allowed, worked exactly as designed.
2. Two later dispatches of the same substance (verify, then countersign; register a distinct principal if the shared default is refused as same-actor) — both blocked: "Permission for this action was denied by the Claude Code auto mode classifier."

The blocked prompts differ from the allowed one mainly in that they state the register-principal step more prominently. From outside, "register a new principal, then countersign" pattern-matches identity-manufacture/self-approval; in this system it is the documented mechanism, and the database itself refuses any actually-non-distinct review regardless of what the agent does.

Impact

Every deferred-review obligation now requires the human operator to open a second interactive session and hand-write each countersign (the kernel also refuses bare-shell writes by design — stamps are minted by the hook interception), turning a fully mechanized review pipeline into per-item manual toil.

Asks (any of these would resolve it)

• A documented way to allowlist a dispatch shape for the auto-mode classifier (the denial text suggests "add a Bash permission rule", but the block occurs at Agent-dispatch time — it is unclear whether/which Bash rule is consulted for the subagent's future commands).
• Classifier consideration of session-local precedent: an identical-substance dispatch was allowed minutes earlier and completed cleanly.
• Surfacing WHICH phrase/feature triggered the denial, so orchestrators can distinguish 'rephrase honestly' from 'this class is intentionally always blocked'.

Note

No complaint about the classifier existing — in most codebases this pattern SHOULD be suspicious. The gap is that there is no override path for systems whose own enforcement layer is strictly stronger than the heuristic.