Fable 5 cyber safeguard false-positives on legitimate IT-admin work; auto-switch to Opus 4.8 forces costly rewind-and-retry

Describe the issue

Fable 5's cyber safeguards repeatedly flag legitimate IT-administration work, and each flag silently switches the session to Opus 4.8. I'm a solo IT admin (Microsoft 365 / Entra ID global admin, network gear) using Claude Code in the desktop app as my daily admin environment.

Tasks that trigger the [cyber] flag are ordinary defensive administration of my own infrastructure, for example:

• Configuring SSH brute-force protection (log-based auto-ban) on our own MikroTik routers
• Security audits of our own M365 tenant: sign-in log review, license/account audits, offboarding (disabling accounts, resetting passwords)
• Firewall / NAT / VPN (WireGuard) configuration on equipment we own

Why this hurts

1. The switch to Opus 4.8 is automatic; to get back on Fable 5 I have to "Rewind and retry", which re-sends a long session context — burning significant usage on a paid Max plan just to undo a false positive.
2. The alternative ("Don't switch models automatically") just fails the request instead, which is worse for workflow.
3. For an infra-admin repo, the flag fires regularly, so the friction is constant, not occasional.

What I'd like

• Better calibration for defensive/admin context (own-tenant audits, own-router hardening are the bread and butter of IT administration), or
• A cheaper recovery path than full rewind-and-retry (e.g. retry only the flagged message on the original model), or
• A per-project/user setting to acknowledge the dual-use context once instead of per-message.

Environment

• Claude desktop app (Code tab), macOS (Darwin 24.6.0)
• Model: Fable 5 (claude-fable-5), auto-switched to Opus 4.8 with Details: [cyber]

Filed by Claude Code on the user's behalf at their request.