On September 10, Anthropic shipped two things for Managed Agents. One is a third permission policy, the other a CLI command. Both aim at the same question: how do you stay in control of an agent that works alone for hours?
Before, it was all or nothing
A toolset knew exactly two policies. always_allow runs without asking. always_ask pauses and waits. The defaults are always_allow for the agent toolset and always_ask for MCP toolsets — sensible, since an MCP server can add a new tool at any time.
Both only cover the edges. Allow everything and you have no control. Ask about everything and you’re sitting there clicking.
What auto does
auto evaluates each call individually, on the server. The evaluation takes in the tool, the concrete input, and the session’s content so far. So the same call to the same tool can go two different ways. Three outcomes are possible:
- It runs. If the server judges the call safe, the tool runs as it would under
always_allow. - It’s denied. If the server evaluates the call as high-risk, the tool doesn’t run. The agent gets an error result with
is_error: trueand text saying permission was denied. The session keeps going. Your client cannot override the denial. - It asks. If the server reaches no determination, the session pauses as under
always_ask.
You turn it on with permission_policy: {"type": "auto"}, in the same two places as the other policies: a toolset’s default_config, or a configs entry for a single tool. No toolset uses auto by default. The obvious pattern will be auto as the default with bash on always_ask.
All of it shows up in the event stream. agent.tool_use and agent.mcp_tool_use always carried evaluated_permission with the outcome of the check — allow, ask or deny. New is an evaluation object naming the policy that produced that outcome, and under auto the server’s determination plus a reason_code when the outcome was ask or deny.
The paragraph worth reading
Anthropic spells out where the boundary runs, and it’s unusually candid.
What you post in user.message events counts as your intent — and it can get the server to allow a call it would otherwise deny. The server reads no intent from a tool result, a fetched webpage, an MCP server’s response, or a message between session threads. It assesses that content, but it doesn’t take instructions from it.
Then the sentence that matters: if you relay untrusted end-user input in user.message events, the server reads that input as your intent too. An end user can get a call allowed that way. Anthropic says what to do about it: configure always_ask on the tools you wouldn’t let that end user run without review.
And a second warning: auto is not a human checkpoint. If the server determines a call is safe, it runs before anyone sees it, and the effects may not be reversible.
That’s not a footnote. Treat auto as a substitute for oversight and you’ve added a layer of automation that is helpless at exactly the question oversight exists for.
Part two: attach to the session live
ant beta:sessions connect <session-id> attaches your terminal to a running Managed Agents session. It loads the transcript and follows it live, tool calls appear with duration and outcome, and a status bar tells you whether the session is running, idle, or waiting for your approval.
You can step in. Enter sends a message, Esc interrupts the agent, Ctrl+O unfolds tool inputs, results and token usage. When a call is waiting for approval, the input line becomes the question — Yes, No, or No with a reason that reaches the agent as deny_message. Ctrl+C detaches and the session keeps running. With --web, the Console’s session viewer opens locally in your browser instead. In scripts you use ant beta:sessions:events stream and send, because connect needs an interactive terminal.
Reading it
The CLI command is the thing that was missing. You cannot operate a long-running agent without a view inside it, and a browser dashboard is the second-best option when you’re debugging.
auto is the more interesting half, and the trickier one. The idea is right: the server sees the call in context and can therefore judge it better than a static rule list. But that moves the question rather than answering it. Before, you decided which tools run freely. Now a model decides about individual calls, and you only decide where you trust that judgment. Anthropic putting the limits in the documentation instead of in a footnote speaks well of them. Somebody still has to read it.
Sources: Claude Platform release notes, September 10, 2026, Permission policies, Connect to a Managed Agents session from your terminal