Managing false positives in WAF policy

You're right in your thinking - if you accept that suggestion, ASM will disable that specific signature on the Wildcard parameter, which is probably not the most ideal move.

Would it be possible to create a specific parameter in the policy and then disable the signature on that? You'd get fine grained control of signatures that way, and only disable the problematic signatures on what is expected to be free-text input (as you've found XSS & SQL injection signatures can be problematic on things like blog content where natural language or mark-up can quite often collide with signatures).

There isn't a mechanism (AFAIK) to tie the enforcement of signatures back to cookies or authenticated users (which, reading between the lines, seems to be what you're aiming for), but something you might like to investigate is the Session Awareness functionality. Using that and the Delayed Blocking feature could allow you to suppress the blocking action for users with valid sessions for a given number of violations in a defined time period; assuming that a user isn't going to sit there submitting content rapid-fire, of course! Would that get you closer?