{"slug": "claude-managed-agents-add-auto-permission-mode-heres-what-changes", "title": "Claude Managed Agents Add ‘Auto’ Permission Mode — Here’s What Changes", "summary": "Anthropic shipped a third permission policy called `auto` for Claude Managed Agents on September 10, routing each tool call to a server-side evaluator that returns allow, ask, or deny. Anthropic said the evaluator blocked 89 percent of dangerous commands in testing, versus 13.6 percent blocked by human reviewers in an independent study, and that a Trajectory Labs evaluation found zero of 720 prompt injection attempts succeeded against agents running in auto mode. The change follows Anthropic's finding that 93 percent of manual permission prompts get approved anyway, and no toolset uses `auto` by default — teams opt in at the toolset or per-tool level, with per-tool overrides taking precedence.", "body_md": "Anthropic instrumented Claude Code and found that 93 percent of manual permission prompts get approved anyway. That single number explains everything wrong with `always_ask` as a production strategy: you are interrupting your agent pipeline hundreds of times per session to rubber-stamp routine operations. It is friction pretending to be safety.\n\nOn the other side, `always_allow` — the default for the built-in agent toolset — skips the interruptions entirely and trusts the agent to do the right thing on every call. Fine in development. Not a policy you want running bash commands against production infrastructure.\n\nTeams shipping Claude Managed Agents to production have been stuck choosing between the two. That changed on September 10, when Anthropic shipped a third option: `auto`.\n\n## How the Auto Policy Works\n\nWhen you set a toolset’s permission policy to `auto`, each tool call routes to a server-side evaluator before execution. The evaluator weighs three inputs: the tool being called, the arguments for that specific call, and the full session history up to that point. It returns one of three decisions:\n\n- **Allow** — the call executes normally\n- **Ask** — execution pauses and the call surfaces to a human for approval\n- **Deny** — the call is blocked and Claude must find another approach\n\nThe context-dependence is the interesting part. The same `bash` call — say, `rm -rf ./tmp` — can be allowed in one session (temporary build artifacts being cleaned up) and denied in another (the evaluator flags it as destructive given prior commands in that session). The decision is not purely rule-based; it reflects what the agent has been doing.\n\nTool call events gain two new fields under `auto`: `evaluated_permission` (set to `\"allow\"`, `\"ask\"`, or `\"deny\"`) and a `reason_code` on denial events — either `high_risk` for an outright block or `indeterminate` when the evaluator reaches no clear conclusion and escalates to a human. These fields are in the event payload, so you can build logging and alerting on top of them.\n\n## How to Opt In\n\nNo toolset uses `auto` by default. You enable it at the toolset level, the per-tool level, or both. Per-tool overrides win over toolset defaults, which means you can run most tools on `always_allow` while singling out high-risk operations for `auto` evaluation:\n\n```\nname: Coding Assistant\nmodel: claude-opus-5\ntools:\n  - type: agent_toolset_20260401\n    default_config:\n      permission_policy:\n        type: always_allow\n    configs:\n      - name: bash\n        permission_policy:\n          type: auto\n```\n\nThis configuration lets read and write operations run freely while sending every bash call through the server evaluator. For MCP toolsets, set `default_config.permission_policy` on the `mcp_toolset` entry the same way — tool names should match what the MCP server reports.\n\n## Sessions Connect: Handling the Escalations\n\nWhen `auto` routes a call to `ask`, someone has to handle the approval request. That is what `ant beta:sessions connect` is for. The command attaches your terminal to a live agent session and follows its transcript in real time. Waiting tool calls surface as an inline prompt — allow or deny — without leaving the terminal.\n\nIf you prefer a browser UI, add `--web`: it serves the Claude Console session viewer on localhost and opens the session there. Either way, you are not polling a dashboard — you connect to the session and stay attached until the agent finishes or you disconnect.\n\n## Why This Changes the Equation\n\nIn an independent study, human reviewers blocked 13.6 percent of dangerous commands during agent runs. The `auto` evaluator blocked 89 percent of the same commands, and a separate evaluation by Trajectory Labs found that zero out of 720 prompt injection attempts succeeded against agents running in auto mode. These are not marketing claims — they are the numbers Anthropic published when they [wrote up how they built the feature](https://www.anthropic.com/engineering/claude-code-auto-mode).\n\nThere is also a compliance angle. EU AI Act Article 14 sets human oversight requirements for high-risk AI systems, with enforcement that began in August 2026. The `evaluated_permission` and `reason_code` fields in every tool call event give you a structured audit trail by default. `always_allow` gives you nothing; `always_ask` gives you a log of rubber stamps. `auto` gives you a log of actual decisions with reasoning.\n\nThe [official permission policies documentation](https://platform.claude.com/docs/en/managed-agents/permission-policies) covers the full configuration reference. For additional context on human-in-the-loop patterns in production agents, [this 2026 guide to HITL agent design](https://getclaw.sh/blog/human-in-the-loop-ai-agents-approvals-2026) is worth the read. If you are currently running any Managed Agents toolset in production on `always_allow`, switching bash and file-write operations to `auto` today is the move — the throughput impact is minimal, and the safety delta is not.", "url": "https://wpnews.pro/news/claude-managed-agents-add-auto-permission-mode-heres-what-changes", "canonical_source": "https://byteiota.com/claude-managed-agents-add-auto-permission-mode-heres-what-changes/", "published_at": "2026-09-15 01:09:47+00:00", "updated_at": "2026-09-15 01:31:07.469154+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-products", "ai-tools", "developer-tools"], "entities": ["Anthropic", "Claude Managed Agents", "Claude Code", "Trajectory Labs", "Claude Console", "claude-opus-5"], "alternates": {"html": "https://wpnews.pro/news/claude-managed-agents-add-auto-permission-mode-heres-what-changes", "markdown": "https://wpnews.pro/news/claude-managed-agents-add-auto-permission-mode-heres-what-changes.md", "text": "https://wpnews.pro/news/claude-managed-agents-add-auto-permission-mode-heres-what-changes.txt", "jsonld": "https://wpnews.pro/news/claude-managed-agents-add-auto-permission-mode-heres-what-changes.jsonld"}}