[Bug] Safety classifier false positives blocking legitimate cloud-security development workflows

Bug Description
Subject: False positive blocking defensive cloud-security development (solo founder, time-sensitive)
▎
▎ I'm a solo founder building a cyber-defense product for AI-agent environments. The product reads a customer's own AWS CloudTrail logs, read-only, to detect when AI-agent sessions fan out as a "swarm" and break the customer's own declared security rules (e.g., touching protected data or disabling audit logs). It then recommends reversible containment, with a human approving by default.
▎
▎ In this session the safety classifier repeatedly stopped Claude mid-response while writing:
▎ 1. a containment planner (reversible IAM deny policies and AWS's documented session-revocation mechanism, applied only in the customer's own account, with an undo journal);
▎ 2. an incident report renderer for the detections, which is pure display code.
▎
▎ The whole context is defensive: labeled synthetic test data from documentation IP ranges, an existing locked rule that autonomous action is allowed only on customer-declared rules and never on anomaly scores, and human approval by default. Category peers (Zenity, Onyx, Wiz, CrowdStrike) ship this functionality commercially.
▎
▎ The interruptions leave half-written files and block a legitimate, time-sensitive build. Please review the session and adjust.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.280
• Feedback ID: 46f1eb96-1b6b-4b80-bcdc-8b0719db5207

Errors

[]