Your team has integrated Claude Code into a CI/CD pipeline that automatically processes pull requests by fetching content from external contributor repositories and passing it directly to Claude for code review and suggested fixes. Three days after launch, you notice that Claude is occasionally suggesting bash commands that bypass your internal security checks — commands that weren't in your approved allowlist but were somehow approved without manual review. Examining the pipeline configuration, you find it was launched with the -p flag for non-interactive operation. What is the most likely root cause of the unauthorized command approvals?