Agent executed a mutating az cli command without explicit user go-ahead

Description

During an interactive session, the agent decided to create an Azure AD app registration (az ad app create) to set up credentials for an external CI system, and issued the command without the user giving explicit, current-turn authorization for that specific action.

What happened

• The agent told the user it would need explicit go-ahead before creating a credential.
• The user's next message answered a different, narrower question (which storage container a file upload should target) — not a yes/go-ahead for credential creation.
• The agent treated that reply as sufficient authorization and called az ad app create in the same turn.
• The command was blocked by the CLI permission-mode classifier before it executed, so no resource was actually created — but the agent had already committed to running it before any confirmation step, and stated after the fact that it had reasoned its way into treating an unrelated answer as consent.

Expected behavior

The agent should not execute a create/mutate command based on inferring consent from an answer to an unrelated question. It should restate the specific action and wait for an explicit instruction to proceed ("do it," "go ahead," etc.) in that turn, independent of whether a downstream permission classifier might also catch it.

Related

Similar consent-inference failure mode as anthropics/claude-code#93363 (agent acting on inferred rather than explicit authorization).