Claude infers permission to touch an explicitly forbidden folder from an unrelated general statement

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

I gave Claude Code an explicit instruction not to touch a specific folder (named "DO NOT TOUCH ORIGINAL"). Separately, I said "we work out of the [X] folder" as a general statement about where our working files should live — not as permission to take any specific action.

Claude then executed a file-move operation whose source path was inside the folder I'd said not to touch, treating my general statement as implicit permission to do so. It did not stop to flag the conflict or ask for explicit confirmation before touching the forbidden folder, even though it had itself acknowledged the "do not touch" instruction earlier in the conversation.

Expected behavior: when a needed file/action lives inside or requires touching an explicitly forbidden location, Claude should stop and surface the conflict directly, asking for explicit permission — never infer permission from an unrelated general statement.

### What Should Happen?

I gave Claude Code an explicit instruction not to touch a specific folder (named "DO NOT TOUCH ORIGINAL"). Separately, I said "we work out of the [X] folder" as a general statement about where our working files should live — not as permission to take any specific action.

Claude then executed a file-move operation whose source path was inside the folder I'd said not to touch, treating my general statement as implicit permission to do so. It did not stop to flag the conflict or ask for explicit confirmation before touching the forbidden folder, even though it had itself acknowledged the "do not touch" instruction earlier in the conversation.

Expected behavior: when a needed file/action lives inside or requires touching an explicitly forbidden location, Claude should stop and surface the conflict directly, asking for explicit permission — never infer permission from an unrelated general statement.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

Establish an explicit, absolute boundary: tell Claude a specific folder must never be touched (e.g., a folder named "DO NOT TOUCH").
Confirm Claude acknowledges this boundary (it did, and even referenced it correctly at one point).
Later in the same conversation, separately state a general working-directory preference unrelated to that specific folder (e.g., "we work out of folder X") — not phrased as a command to take any particular action.
Ask Claude a question that reveals a file it needs to reference/edit happens to live inside the forbidden folder from step 1.
Observe that instead of stopping to flag the conflict ("this file lives inside the folder you said not to touch — how do you want to handle it?"), Claude treats the earlier general statement from step 3 as implicit permission, and executes a file-move operation whose source path is inside the forbidden folder — without asking first.
Expected: Claude should stop at step 4/5 and explicitly surface the conflict, asking for permission before taking any action that touches the forbidden folder.
Actual: Claude inferred permission from an unrelated statement and acted on the forbidden folder without asking.

### Claude Model

None

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

claude-sonnet-5

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

Windows Terminal

### Additional Information

_No response_

Start by trying to reproduce the described conversation in Claude Code on Windows/Anthropic API: create a forbidden folder, confirm the boundary, then introduce an unrelated working-directory preference before a file action. The issue names no files or tests, so first read the code paths that decide whether filesystem operations are allowed or need confirmation. Done means Claude surfaces the conflict and asks before any operation touching the forbidden folder.

Vom Indexierungsmodell aus dem Issue-Text verfasst.