Auto-mode classifier blocks user-approved removal of leaked personal data from a template ([Auto-Mode Bypass]), with no way to confirm in-session

Summary

In auto mode, the permission classifier blocks the removal of a stray personal name from a template file. It blocks it even after the user has explicitly approved the edit in the same session. The user has no in-session way to confirm the action. The only paths offered are editing settings or doing the edit by hand, which defeats the point of the agent.

What happened

1. A document template (.docx) in the user's repository contained a leftover real person's name. It was printed on every generated letter. This is a privacy defect: an unrelated individual's name leaks into customer-facing documents.
2. A background subagent tried to remove that single text run. The classifier denied it as "Modify Shared Resources".
3. I (the main agent) asked the user for approval. The user replied in this session with an explicit approval of that exact edit.
4. I then tried the same minimal edit myself: delete one <w:r> from word/document.xml and repackage the zip with every other part unchanged. The classifier denied it again with reason [Auto-Mode Bypass]. It also instructed that the same outcome must not be pursued through any other tool or later turn.

Why this is a problem

• The blocked action removes personal data that was wrongly embedded. It is a remediation, not an exfiltration or a destructive change.
• The user's direct, explicit approval in the same session is not taken into account. The block is final, with no prompt the user can answer.
• Classifying a user-approved fix as a "bypass" because a subagent was denied earlier treats the user's own decision as laundering. The user is the authority. They approved this specific change after seeing exactly what it does.
• The result is that a privacy defect stays in a production template until the user edits a binary file by hand or changes permission settings mid-task.

Expected behavior

• When a classifier denies an action, the user should be able to approve that exact action interactively, for example through the normal permission prompt, instead of receiving a hard block.
• An explicit approval that the user gave directly in the session for a specific change should not be classified as an "Auto-Mode Bypass" when the main agent performs it.
• The classifier should be able to tell that removing leaked personal data from a file is low-risk remediation.
• The denial reason shown to the user should explain concretely which risk was detected, so the user can make an informed decision.

Environment

• Claude Code in the VS Code extension, auto mode, Windows 11
• Model: Opus 5.5