Can a client override a call that auto denied?

No. When the server rates a call high-risk under auto, the tool does not run and the agent receives an error tool result reading "Permission to use {tool_name} has been denied." with is_error set to true. The session keeps going, and sending a user.tool_confirmation event for that call is rejected with a 400 error.

Is auto a replacement for human review?

Anthropic's documentation says plainly that auto is not a human checkpoint. When the server determines a call is safe, that call runs before anyone sees it, and its effects might not be reversible. For any tool a person must review first, the guidance is to keep always_ask configured on that specific tool instead.

How do I tell which policy decided a tool call?

Every agent.tool_use and agent.mcp_tool_use event carries evaluated_permission, set to "allow", "ask" or "deny", plus an evaluation object whose type names the policy behind it. Under auto that object also records a reason_code — high_risk for a denial, indeterminate when the server reached no decision — for clients to branch on and log.

What does ant beta:sessions connect give you over the raw API?

The command attaches an interactive terminal to a running Claude Managed Agents session and follows its transcript live. Enter sends a message, Esc interrupts the agent, Ctrl+O toggles tool inputs and token usage, and a waiting call prompts Allow tool call?. Adding --web serves the Console's session viewer from 127.0.0.1 instead.

Anthropic · 2026-09-10 · major

Claude Managed Agents add 'auto' mode — the server checks every tool call

Claude Managed Agents add a third permission policy, auto, where Anthropic's server evaluates each agent or MCP tool call and then runs it, denies it, or pauses for your approval. The ant CLI can now attach a terminal to a live session.

Anthropic Claude developer platform release notes card

A third permission policy lets Anthropic's server decide, call by call, whether an agent's tool runs, stops, or waits for you.

Quick facts

Maker	Anthropic
Policy types	always_allow, always_ask, auto
Agent toolset default	always_allow
MCP toolset default	always_ask
Beta header	managed-agents-2026-04-01
New CLI command	ant beta:sessions connect

What is it?

The new auto policy sits between the two settings Claude Managed Agents already had. always_allow runs every tool without asking and always_ask pauses on all of them; auto sends each individual call to the server, which runs it, denies it, or pauses the session for approval. No toolset uses auto by default — you opt in on a whole toolset or on a single tool, and per-tool overrides still win.

How does it work?

Each evaluation weighs the tool, that call's input, and the session content up to that point, so two calls to the same tool can end differently. What you post in user.message events counts as your intent and can get a borderline call allowed. Content arriving in a tool result, a fetched web page or an MCP server's response is assessed but never followed as instructions, and some calls are rated high-risk no matter who asks.

Why does it matter?

Approval prompts are the first thing people switch off, and always_allow on a bash tool is how an agent ends up deleting a directory nobody meant to touch. A per-call check gives teams a middle setting instead of that all-or-nothing choice. The matching ant beta:sessions connect command covers the other half: a human can watch and steer a live session from a terminal without building a review UI first.

Who is it for?

teams building on the Claude Managed Agents API

Frequently asked questions

Can a client override a call that auto denied?: No. When the server rates a call high-risk under auto, the tool does not run and the agent receives an error tool result reading "Permission to use {tool_name} has been denied." with is_error set to true. The session keeps going, and sending a user.tool_confirmation event for that call is rejected with a 400 error.
Is auto a replacement for human review?: Anthropic's documentation says plainly that auto is not a human checkpoint. When the server determines a call is safe, that call runs before anyone sees it, and its effects might not be reversible. For any tool a person must review first, the guidance is to keep always_ask configured on that specific tool instead.
How do I tell which policy decided a tool call?: Every agent.tool_use and agent.mcp_tool_use event carries evaluated_permission, set to "allow", "ask" or "deny", plus an evaluation object whose type names the policy behind it. Under auto that object also records a reason_code — high_risk for a denial, indeterminate when the server reached no decision — for clients to branch on and log.
What does ant beta:sessions connect give you over the raw API?: The command attaches an interactive terminal to a running Claude Managed Agents session and follows its transcript live. Enter sends a message, Esc interrupts the agent, Ctrl+O toggles tool inputs and token usage, and a waiting call prompts Allow tool call?. Adding --web serves the Console's session viewer from 127.0.0.1 instead.

Try it

ant beta:sessions connect <session-id>