# Claude Managed Agents Add ‘Auto’ Permission Mode — Here’s What Changes > Source: > Published: 2026-09-15 01:09:47+00:00 Anthropic instrumented Claude Code and found that 93 percent of manual permission prompts get approved anyway. That single number explains everything wrong with `always_ask` as a production strategy: you are interrupting your agent pipeline hundreds of times per session to rubber-stamp routine operations. It is friction pretending to be safety. On the other side, `always_allow` — the default for the built-in agent toolset — skips the interruptions entirely and trusts the agent to do the right thing on every call. Fine in development. Not a policy you want running bash commands against production infrastructure. Teams shipping Claude Managed Agents to production have been stuck choosing between the two. That changed on September 10, when Anthropic shipped a third option: `auto`. ## How the Auto Policy Works When you set a toolset’s permission policy to `auto`, each tool call routes to a server-side evaluator before execution. The evaluator weighs three inputs: the tool being called, the arguments for that specific call, and the full session history up to that point. It returns one of three decisions: - **Allow** — the call executes normally - **Ask** — execution pauses and the call surfaces to a human for approval - **Deny** — the call is blocked and Claude must find another approach The context-dependence is the interesting part. The same `bash` call — say, `rm -rf ./tmp` — can be allowed in one session (temporary build artifacts being cleaned up) and denied in another (the evaluator flags it as destructive given prior commands in that session). The decision is not purely rule-based; it reflects what the agent has been doing. Tool call events gain two new fields under `auto`: `evaluated_permission` (set to `"allow"`, `"ask"`, or `"deny"`) and a `reason_code` on denial events — either `high_risk` for an outright block or `indeterminate` when the evaluator reaches no clear conclusion and escalates to a human. These fields are in the event payload, so you can build logging and alerting on top of them. ## How to Opt In No toolset uses `auto` by default. You enable it at the toolset level, the per-tool level, or both. Per-tool overrides win over toolset defaults, which means you can run most tools on `always_allow` while singling out high-risk operations for `auto` evaluation: ``` name: Coding Assistant model: claude-opus-5 tools: - type: agent_toolset_20260401 default_config: permission_policy: type: always_allow configs: - name: bash permission_policy: type: auto ``` This configuration lets read and write operations run freely while sending every bash call through the server evaluator. For MCP toolsets, set `default_config.permission_policy` on the `mcp_toolset` entry the same way — tool names should match what the MCP server reports. ## Sessions Connect: Handling the Escalations When `auto` routes a call to `ask`, someone has to handle the approval request. That is what `ant beta:sessions connect` is for. The command attaches your terminal to a live agent session and follows its transcript in real time. Waiting tool calls surface as an inline prompt — allow or deny — without leaving the terminal. If you prefer a browser UI, add `--web`: it serves the Claude Console session viewer on localhost and opens the session there. Either way, you are not polling a dashboard — you connect to the session and stay attached until the agent finishes or you disconnect. ## Why This Changes the Equation In an independent study, human reviewers blocked 13.6 percent of dangerous commands during agent runs. The `auto` evaluator blocked 89 percent of the same commands, and a separate evaluation by Trajectory Labs found that zero out of 720 prompt injection attempts succeeded against agents running in auto mode. These are not marketing claims — they are the numbers Anthropic published when they [wrote up how they built the feature](https://www.anthropic.com/engineering/claude-code-auto-mode). There is also a compliance angle. EU AI Act Article 14 sets human oversight requirements for high-risk AI systems, with enforcement that began in August 2026. The `evaluated_permission` and `reason_code` fields in every tool call event give you a structured audit trail by default. `always_allow` gives you nothing; `always_ask` gives you a log of rubber stamps. `auto` gives you a log of actual decisions with reasoning. The [official permission policies documentation](https://platform.claude.com/docs/en/managed-agents/permission-policies) covers the full configuration reference. For additional context on human-in-the-loop patterns in production agents, [this 2026 guide to HITL agent design](https://getclaw.sh/blog/human-in-the-loop-ai-agents-approvals-2026) is worth the read. If you are currently running any Managed Agents toolset in production on `always_allow`, switching bash and file-write operations to `auto` today is the move — the throughput impact is minimal, and the safety delta is not.