# Mistral Studio Agents SDK: Tool Calls Run by Default — Set a Policy First

> Source: <https://byteiota.com/mistral-studio-agents-sdk-tool-calls-default-policy/>
> Published: 2026-11-08 19:05:52+00:00

Mistral launched managed agents, an Agents SDK, a workflow builder, and an Apps CLI into public preview on November 5. It is a real enterprise agent platform — write your agent code once and run it on Mistral’s cloud or your own servers. Before you deploy anything into production, there is one thing you need to know: by default, the SDK auto-approves every tool call your agent decides to make. No confirmation. No human in the loop. Just execution.

## What Launched

The November 5 release covers more ground than a typical preview. **Managed Agents** let you run the same Python agent code on Mistral’s infrastructure or your own machines — a genuine hybrid deployment option that neither Claude Managed Agents nor AWS AgentCore currently matches cleanly. The **Agents SDK** (`pip install "mistralai[agents]"`, Python 3.12+ required) ships as `mistralai-agents` and is the foundation for all of it.

Beyond the SDK: a **Workflow Builder** that takes a plain-English description and produces working, editable workflow code via [Vibe](https://github.com/mistralai/mistral-vibe); an **Apps CLI** for scaffolding and deploying Studio apps; an evaluation SDK; built-in agent tracing with zero extra setup; webhooks; and managed search indexes. The workflow builder is generally available. Everything else is in public preview.

## The Default You Need to Change Before Going Live

The SDK ships with `permission_mode="auto"` and no permission policy. [Mistral’s own documentation](https://docs.mistral.ai/resources/release-notes) puts it plainly: an agent with no `permission_policy` and the default mode runs every tool call it decides to make. If your agent has write access to anything — a database, an external API, a file system — that call executes without review.

This is not a niche edge case. It is the default. The fix is explicit but not obvious from a first read of the quickstart:

``` python
from mistralai import agents

policy = agents.PermissionPolicy(
    agents.PermissionRule(
        # auto-approve tools with read_only_hint,
        # send everything else to a human reviewer
    )
)

agent = agents.Agent(
    permission_policy=policy,
)
```

Mistral’s own example pattern is to auto-approve tools that carry a `read_only_hint` annotation and route all others to human review. That is the right default. It is just not what ships out of the box. [The developer community has already flagged this as a production risk.](https://dev.to/gabrielanhaia/mistrals-new-agents-sdk-runs-tool-calls-without-asking-by-default-set-a-policy-first-5315)

Set the policy before you connect any tool that can mutate state. If you are building a research-only agent that calls nothing but web search and read-only APIs, the default is fine. Almost every real use case goes beyond that.

## Self-Hosted Still Phones Home

Mistral’s pitch has always included data sovereignty — a European alternative when you need control over where your data goes. The managed agents preview has a limitation worth flagging: when you run agents on your own infrastructure, session state and traces still route back to Mistral. Full on-premises deployment, where the entire platform runs in your environment, is a separate Enterprise tier not available until the end of November.

Until then, “self-hosted” means the agent code runs on your machines but the control plane and telemetry stay with Mistral. Apps are cloud-only for now. [A detailed breakdown of the current self-hosted limits versus AgentCore and Claude Managed Agents](https://www.beri.net/article/mistral-studio-managed-agents-apps-public-preview-mistral-hosted-self-hosted-limits-no-pricing-vs-agentcore-claude-managed-agents) is worth reading before you commit to any architecture decision.

## How It Compares

Mistral Studio now joins Claude Managed Agents (GA since April 2026) and AWS Bedrock AgentCore in the managed-agent-infrastructure category. The natural language workflow builder is a genuine differentiator — neither Anthropic nor AWS ships anything equivalent in their managed agent products. On pricing, Mistral has published nothing for managed agents, apps, or evaluations; Anthropic charges $0.08 per active session-hour plus normal token costs. The lack of pricing transparency is a friction point for anyone trying to run a build-vs-buy calculation right now.

## Bottom Line

The Mistral Studio agent platform is worth taking seriously, but not at default settings. Two things to do before you ship anything: set an explicit permission policy so your agent does not auto-execute write operations, and confirm whether the current telemetry model is acceptable for your data requirements. Watch for the on-premises GA (targeting end of November) and pricing announcements — both will determine whether this competes head-to-head with the existing options or stays a preview curiosity.