Claude Managed Agents permission policies now come in three types — always_allow, always_ask, and a new auto mode released on 10 September 2026 — and auto is the interesting one: instead of you pre-deciding whether a tool runs, the server evaluates each agent or MCP tool call as it happens and either runs it, denies it, or pauses the session for your approval. That is per Anthropic's official platform release notes, published 10 September 2026, and it means you no longer have to choose between approving everything (slow) and approving nothing (risky).
📺 Watch: Claude Can Now Control Your Computer in the Background
🔥 Get the Agent OS as a free bonus: AI Profit Boardroom members get the full Agent OS zip, prompt libraries, daily tutorials and weekly live coaching calls. → Get inside · Want AI SEO help 1-on-1? Book a free SEO strategy session →
Permission policies control whether server-executed tools — the pre-built agent toolset and any MCP toolsets you connect — run automatically, wait for approval, or now get judged call-by-call; custom tools sit outside the system, because your own application executes those. The same release notes also added a new ant CLI command, ant beta:sessions connect, which attaches your terminal to a live Managed Agents session to watch it work, send messages, and approve or deny waiting tool calls. Together, the two give you a middle path between full autonomy and constant supervision.
What Changed on 10 September 2026
According to the release notes, two things shipped for Managed Agents on 10 September 2026. First, permission policies gained the auto type: the server evaluates every agent or MCP tool call and picks one of three outcomes — run it, deny it, or pause for your approval. Second, every agent.tool_use and agent.mcp_tool_use event now reports how the call was evaluated, in an evaluation field alongside evaluated_permission — meaning the permission system now leaves an audit trail you can read programmatically, not just outcomes you infer after the fact.
How Claude Managed Agents Permission Policies Work
The permission policy model in Claude Managed Agents is simple to hold in your head. Every server-executed toolset carries a policy, and per Anthropic's documentation there are now three to choose from:
| Policy | What it does |
|---|---|
| always_allow | The tool executes automatically with no confirmation |
| always_ask | The session pauses and waits for your approval before executing |
| auto (new) | The server evaluates each call and runs it, denies it, or pauses for your approval |
The defaults are worth knowing before you touch anything. The pre-built agent toolset defaults to always_allow, while MCP toolsets default to always_ask — sensible, since a new tool appearing on an MCP server should not execute in your application without sign-off. No toolset uses auto by default: you opt in deliberately, in the agent's tools configuration, and policy changes only apply to sessions created afterwards. You can also override the policy for a single tool: the documentation's own example allows the full agent toolset by default but keeps bash on always_ask, so shell commands still need a human even when everything else flows freely.
If you want working agent systems that earn their autonomy — permissioned properly, orchestrated properly, and actually shipping business output — check out the AI Profit Boardroom → get the full Agent OS build inside. Want AI SEO help 1-on-1 instead? Book a free SEO strategy session and map it out with Julian directly.
The Auto Policy: Three Outcomes for Every Tool Call
Auto works because the evaluation is contextual. Per the documentation, the server considers the tool, the call's specific input, and the session's content up to that point — which means two calls to the same tool can be treated differently. A file-read into your workspace and a shell command that deletes a reports directory are not the same risk, and now they are not the same decision. Each call under auto lands in one of three buckets:
- The call runs. The server determines the call is safe and executes it exactly as it would under always_allow. No pause, no latency tax on routine work.
- The call is denied. The server evaluates the call as high-risk and refuses it. The agent receives an error tool result stating permission has been denied, the session keeps running, and — importantly — your client cannot override the denial.
- The call pauses. The server reaches no determination, so the session waits for your approval exactly as it would under always_ask, and you respond with a user.tool_confirmation event set to allow or deny.
One caution Anthropic states plainly in the documentation, and it deserves repeating: auto is not a human checkpoint. If the server judges a call safe, it runs before anyone sees it, and its effects might not be reversible. Anything a person must review before it executes belongs on always_ask, full stop. The docs also address prompt injection: the server takes instructions only from what you post in user.message events, never from tool results, fetched webpages or MCP responses — though if you relay untrusted end-user input in your messages, the server reads that as your intent too, so keep such tools on always_ask.
Reading the Evaluation Trail
Under any policy, each agent.tool_use and agent.mcp_tool_use event now carries evaluated_permission — the outcome of the call's permission check, reported as allow, ask or deny. Most events also carry an evaluation object naming which policy produced that outcome, and under auto it additionally records a reason_code when the outcome is ask or deny: high_risk for denials, indeterminate when the server could not decide and punted to you. Anthropic notes the reason_code is a value for your client to branch on and keep in audit records, not text to show end users. For anyone running agents against real business systems, this is the quiet win of the release — permission decisions stop being invisible and become data you can log, monitor and alert on.
📺 Watch: Building AI Agent Operating Systems with Claude
Approving Calls Live with ant beta:sessions connect
The second half of the 10 September release closes the loop on the ask outcome. When a Managed Agents session pauses for approval, you previously answered by sending confirmation events through the API. The new ant beta:sessions connect command gives you a human-friendly alternative: it attaches your terminal to the session so you can follow it live, send messages mid-run, and allow or deny the tool calls that are waiting. Pass the web flag and it serves the Claude Console's session viewer locally, opening the same session in your browser instead. It pairs naturally with auto: routine calls flow, high-risk calls die, and the genuinely ambiguous ones land in a terminal where you tap allow or deny.
What This Means for Your Agent Stack
The practical read: Claude's server-side agents just became easier to run unattended without becoming reckless. A sensible starting configuration from the documented examples: agent toolset on auto, trusted MCP toolsets on auto, and destructive-capable tools like bash pinned to always_ask. That gets you speed on routine calls, a hard server-side floor under dangerous ones, and a human in the loop only where a human adds value. If you are already governing local tooling, the same thinking applies at the machine level — the guide to restricting Claude Code access covers the local-permissions side of the same problem, and pairs well with Claude Code's advisor mode when you want oversight on reasoning rather than just tool use.
Zoom out and this release slots into a bigger pattern: agent platforms are converging on orchestration plus governance as the layer that matters. That is exactly the thesis behind the Agent OS — mission control, memory and permissions treated as one system rather than bolt-ons — and it is why comparing raw model quality only gets you so far; the Goldie Bench write-up covers how the current brains stack up against each other in hands-on tests if the model layer is the bit you are still choosing. Server-evaluated permissions also change the economics of running an agentic OS on Claude Code and its managed siblings: less time approving, more throughput per human hour. And if budget is the blocker, there are legitimate ways to run Claude Code free while you learn the stack — the governance habits transfer straight across when you graduate to managed agents.
Claude Managed Agents Permission Policies FAQs
What are the permission policy types in Claude Managed Agents?
Three, per Anthropic's documentation: always_allow runs the tool automatically, always_ask pauses the session for your approval, and auto — added 10 September 2026 — has the server evaluate each call and run it, deny it, or pause for approval.
What happens when the server denies a call under auto?
The tool does not run, the agent receives an error tool result saying permission was denied, and the session keeps running. Your client cannot override a server denial — the API rejects confirmation events for calls that were not evaluated as ask.
Do Claude Managed Agents permission policies apply to custom tools?
No. Custom tools are executed by your own application, which receives the tool-use event and decides for itself whether to run the call. Policies govern only the server-executed agent toolset and MCP toolsets.
Is auto enabled by default?
No toolset uses auto by default. The agent toolset defaults to always_allow and MCP toolsets default to always_ask; you switch a toolset or an individual tool to auto explicitly in the agent's tools configuration.
How do I approve a paused tool call from my terminal?
Run ant beta:sessions connect, added in the same 10 September 2026 release. It attaches your terminal to the session so you can follow it live, send messages, and allow or deny waiting calls — or add the web flag to open the session in the Claude Console viewer locally.
Verdict: Opt In, but Pin the Sharp Tools
The auto policy is the most useful change to Claude Managed Agents permission policies since the system launched, because it prices risk per call instead of per tool. The configuration that follows from Anthropic's own guidance is not complicated: auto where volume lives, always_ask pinned on anything destructive, and the new evaluation fields flowing into your logs from day one. Set it up that way and your agents get faster without getting looser — which is the entire point of governance done well.
If you want to build agent systems that run your business workflows on autopilot — with the permissioning, prompts and playbooks already done for you — check out the AI Profit Boardroom → join 3,000+ operators inside. And if you would rather talk it through first, book a free SEO strategy session and get a plan for your exact setup.
