Claude Managed Agents adds server-evaluated auto permission policy

Anthropic has added a third permission policy, auto, to Claude Managed Agents, letting the server itself decide — call by call — whether an agent's tool use runs, gets denied, or pauses for human approval.

What's new

Managed Agents previously offered two permission policies for server-executed tools (the pre-built agent toolset and MCP toolset): always_allow, which runs a tool with no confirmation, and always_ask, which pauses every call for approval. The new auto policy sits between them. With it, every call to agent.tool_use or agent.mcp_tool_use is evaluated individually, weighing the tool, its input, and the session's content up to that point, and resolves to one of three outcomes: the call runs as it would under always_allow; the call is denied, returning an error result while the session keeps running; or the call pauses for approval as it would under always_ask. The evaluation outcome is now reported on each event in an evaluated_permission field, alongside a fuller evaluation object that names which policy produced the result and, for auto, includes a reason_code for denials or approval pauses. Developers turn it on by setting permission_policy to {"type": "auto"} at the toolset or individual-tool level; no toolset defaults to it. Alongside the API change, the ant CLI added ant beta:sessions connect, which attaches a terminal to a live Managed Agents session so a developer can watch it run and approve or deny paused tool calls directly from the command line.

Context

Managed Agents is Anthropic's hosted infrastructure for running Claude-driven agents with built-in tool orchestration, and permission policies are its core safety lever for controlling what those agents can do unsupervised. The binary always-allow/always-ask choice forced a tradeoff: blanket trust or a human bottleneck on every call. auto is Anthropic's answer to that tradeoff, moving risk assessment onto the server rather than a fixed rule set.

Why it matters

As agents take on longer, less-supervised runs, per-call human approval becomes the practical ceiling on how much autonomy a team can safely grant. A server-side risk evaluator that can selectively deny high-risk calls while letting routine ones through addresses that bottleneck directly, and it's a notable trust signal: Anthropic is putting its own judgment in the loop for individual tool calls, not just at the model layer. The terminal-attach CLI addition suggests Anthropic expects auto to still generate enough approval pauses that developers need a fast way to watch and respond to them live.