Anthropic instrumented Claude Code and found that 93 percent of manual permission prompts get approved anyway. That single number explains everything wrong with always_ask as a production strategy: you are interrupting your agent pipeline hundreds of times per session to rubber-stamp routine operations. It is friction pretending to be safety.
On the other side, always_allow — the default for the built-in agent toolset — skips the interruptions entirely and trusts the agent to do the right thing on every call. Fine in development. Not a policy you want running bash commands against production infrastructure.
Teams shipping Claude Managed Agents to production have been stuck choosing between the two. That changed on September 10, when Anthropic shipped a third option: auto.
How the Auto Policy Works #
When you set a toolset’s permission policy to auto, each tool call routes to a server-side evaluator before execution. The evaluator weighs three inputs: the tool being called, the arguments for that specific call, and the full session history up to that point. It returns one of three decisions:
- Allow — the call executes normally
- Ask — execution s and the call surfaces to a human for approval
- Deny — the call is blocked and Claude must find another approach
The context-dependence is the interesting part. The same bash call — say, rm -rf ./tmp — can be allowed in one session (temporary build artifacts being cleaned up) and denied in another (the evaluator flags it as destructive given prior commands in that session). The decision is not purely rule-based; it reflects what the agent has been doing.
Tool call events gain two new fields under auto: evaluated_permission (set to "allow", "ask", or "deny") and a reason_code on denial events — either high_risk for an outright block or indeterminate when the evaluator reaches no clear conclusion and escalates to a human. These fields are in the event payload, so you can build logging and alerting on top of them.
How to Opt In #
No toolset uses auto by default. You enable it at the toolset level, the per-tool level, or both. Per-tool overrides win over toolset defaults, which means you can run most tools on always_allow while singling out high-risk operations for auto evaluation:
name: Coding Assistant
model: claude-opus-5
tools:
- type: agent_toolset_20260401
default_config:
permission_policy:
type: always_allow
configs:
- name: bash
permission_policy:
type: auto
This configuration lets read and write operations run freely while sending every bash call through the server evaluator. For MCP toolsets, set default_config.permission_policy on the mcp_toolset entry the same way — tool names should match what the MCP server reports.
Sessions Connect: Handling the Escalations #
When auto routes a call to ask, someone has to handle the approval request. That is what ant beta:sessions connect is for. The command attaches your terminal to a live agent session and follows its transcript in real time. Waiting tool calls surface as an inline prompt — allow or deny — without leaving the terminal.
If you prefer a browser UI, add --web: it serves the Claude Console session viewer on localhost and opens the session there. Either way, you are not polling a dashboard — you connect to the session and stay attached until the agent finishes or you disconnect.
Why This Changes the Equation #
In an independent study, human reviewers blocked 13.6 percent of dangerous commands during agent runs. The auto evaluator blocked 89 percent of the same commands, and a separate evaluation by Trajectory Labs found that zero out of 720 prompt injection attempts succeeded against agents running in auto mode. These are not marketing claims — they are the numbers Anthropic published when they wrote up how they built the feature.
There is also a compliance angle. EU AI Act Article 14 sets human oversight requirements for high-risk AI systems, with enforcement that began in August 2026. The evaluated_permission and reason_code fields in every tool call event give you a structured audit trail by default. always_allow gives you nothing; always_ask gives you a log of rubber stamps. auto gives you a log of actual decisions with reasoning.
The official permission policies documentation covers the full configuration reference. For additional context on human-in-the-loop patterns in production agents, this 2026 guide to HITL agent design is worth the read. If you are currently running any Managed Agents toolset in production on always_allow, switching bash and file-write operations to auto today is the move — the throughput impact is minimal, and the safety delta is not.