Auto mode classifier blocks read-only browser page reads during a user-authorized read-only task

What happened
In auto mode, with Claude in Chrome logged into a SaaS CRM, I explicitly authorized a read-only
investigation ("only read, don't change anything"). The classifier denied two read-only actions:

1. a left_click on the app's sidebar "Settings" item;
2. a javascript_tool call that only read document.body.innerText of a workflow's run-history tab.

Both denials said: "Stage 2 classifier error - blocking based on stage 1 assessment (usually transient —
retrying often succeeds)". Similar read-only page reads on the same site had succeeded earlier in the
same session. The model correctly did not work around the block, so I had to do this step manually.

Expected
Read-only navigation and page-text reads are allowed when the user has explicitly authorized read-only access.

Repro

1. Auto mode on; Claude in Chrome logged into a web CRM.
2. Tell Claude: read only, change nothing.
3. Open an automation → History tab; Claude calls javascript_tool to read innerText (or clicks the sidebar Settings item).
4. The classifier denies the action.

Environment
Claude Code CLI, Linux, Claude in Chrome extension, 2026-10-05.

Note
I can't attach the session transcript: it contains credentials.