Anthropic Adds `auto` Mode to Claude Managed Agents Permission Policies and a `sessions connect` CLI for Live Agent Monitoring

The September 10 platform release notes ship two Managed Agents changes deferred from yesterday's desk sweep. `auto` lets the server evaluate each agent or MCP tool call and run, deny, or pause for approval, with a new `evaluation` field on `agent.tool_use` and `agent.mcp_tool_use` events. `ant beta:sessions connect` attaches the terminal to a live Managed Agents session, with a `--web` flag that serves the Claude Console session viewer locally. Both are primary-source-verified verbatim against platform.claude.com.

<h1>Anthropic Adds auto Mode to Claude Managed Agents Permission Policies and a sessions connect CLI for Live Agent Monitoring</h1>

Anthropic published two Claude Platform release notes on September 10, 2026 that the publication's evening desk sweep on September 11 noted as deferred. The first is the long-promised server-side permission evaluation for Claude Managed Agents: a new <code>auto</code> value in the permission-policy surface that lets Anthropic's server evaluate each agent or MCP tool call and run, deny, or pause for your approval. The second is a new CLI subcommand, <code>ant beta:sessions connect</code>, that attaches the terminal to a live Managed Agents session and offers a <code>--web</code> flag for opening the Claude Console session viewer locally instead. Both were deferred from yesterday's evening sweep (<a href="https://platform.claude.com/docs/en/release-notes/overview">Claude Platform release notes</a>); both ship on the same day; both are documented on primary surfaces.

<h2>What happened</h2>

The September 10 entry on the Claude Platform release notes contains exactly two bullets:

<ul> <li>Permission policies gain an <code>auto</code> value. "Claude Managed Agents permission policies now include <code>auto</code>: the server evaluates each agent or MCP tool call and runs it, denies it, or pauses for your approval. <code>agent.tool_use</code> and <code>agent.mcp_tool_use</code> events report how each call was evaluated in an <code>evaluation</code> field alongside <code>evaluated_permission</code>." See <a href="https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto">Let the server evaluate each call with <code>auto</code></a>.</li> <li>The <code>ant</code> CLI gains <code>beta:sessions connect</code>. "The <code>ant</code> CLI adds <code>ant beta:sessions connect</code>, which attaches your terminal to a Claude Managed Agents session. You can follow the session live, send messages, and allow or deny tool calls that are waiting for approval. Pass <code>--web</code> to serve the Claude Console's session viewer locally and open the session there instead." See <a href="https://platform.claude.com/docs/en/cli-sdks-libraries/cli/sessions-connect">Connect to a Managed Agents session from your terminal</a>.</li> </ul>

Both changes are documented on dedicated pages in the same release window. The <code>auto</code> documentation is a sub-section of the existing <a href="https://platform.claude.com/docs/en/managed-agents/permission-policies">Claude Managed Agents permission policies</a> page; <code>sessions connect</code> is a new page under <a href="https://platform.claude.com/docs/en/cli-sdks-libraries/cli">the CLI documentation surface</a>. Neither change touches Claude Code itself or the consumer <code>claude.ai</code> product surface; both are scoped to the platform-managed-agent product surface where Anthropic runs the agent harness for you.

<h2>What actually changed</h2>

<h3>1. Server-side permission evaluation is now a first-class policy value</h3> Before <code>auto</code>, Managed Agents permission policies were client-defined or always-prompt: an organization could enumerate rules in YAML or rely on the Anthropic server to enforce a global allow/deny, but there was no shared decision surface that combined the agent's declared intent with a server-side ruleset. <code>auto</code> adds that decision surface. The Anthropic server now runs every agent or MCP tool call through a server-side evaluator that picks one of three outcomes: run, deny, or pause for approval. The evaluator's verdict is recorded on the corresponding event: <code>agent.tool_use</code> and <code>agent.mcp_tool_use</code> events now carry an <code>evaluation</code> field alongside <code>evaluated_permission</code>, so audit pipelines can distinguish "the server ran this" from "the server asked the operator first" from "the server denied this without asking."

The semantic shift matters because Managed Agents are Anthropic-operated harnesses: the agent is running on Anthropic's infrastructure with your data, your tools, and your MCP servers. Until today the only way to constrain what the agent did was to constrain what the agent saw at startup. <code>auto</code> pushes the constraint to the call site, which is the only place it can actually stop a destructive action.

<h3>2. <code>ant beta:sessions connect</code> turns the CLI into a Managed Agents console</h3> The second change is a CLI ergonomics win for operators who already run Managed Agents in production. <code>ant beta:sessions connect <session-id></code> attaches your terminal to a running session: you see the session's transcript stream in real time, you can send messages mid-session, and you can approve or deny the tool calls that the <code>auto</code> policy pauses for. The <code>--web</code> flag changes the attachment target: instead of a terminal, you get a local HTTP server serving the Claude Console's session viewer UI, so you can open the session in a browser and use the Console's existing affordances. The <code>beta:</code> prefix indicates the surface is still evolving; the release notes do not yet commit to a GA date.

The practical effect is that operators who were already approving tool calls through the Claude Console can now do the same work without leaving their terminal, or they can move the console-style approval flow onto a workstation where they already have a browser open. The audit trail is the same: the <code>evaluation</code> field on the event records which calls were paused and which were approved.

<h2>Why developers and founders should care</h2> Both changes are operationally load-bearing for any team running Managed Agents in production. Three reasons they should land on your radar this week:

1. <code>auto</code> is the answer to the Managed Agents production-readiness gap. Until today, the realistic options for a production Managed Agents deployment were either always ask (every tool call hits the operator — too noisy for autonomous workflows) or always allow (every tool call runs — too risky for any workflow that touches external state). <code>auto</code> introduces a third option where the server reads the policy and decides for you, only pausing when the policy says it should. The cost is that you have to author a coherent policy: a permissive <code>auto</code> policy is the same risk as always allow. The benefit is that you can run a meaningful agent loop without constant operator involvement.

2. The <code>evaluation</code> field is the new audit primitive. If you already log <code>agent.tool_use</code> and <code>agent.mcp_tool_use</code> events for compliance or incident review, your existing pipeline will now see an <code>evaluation</code> field that was not there before. Backfilling that field into your SIEM, your post-incident review template, and your customer-trust answers is the lowest-effort improvement you can make this week. If you do not yet log these events, today is the moment to start.

3. <code>sessions connect</code> is the missing CLI for anyone already running Managed Agents. Operators who approved tool calls through the Claude Console today will recognize the gap: a CLI session that could pause, examine, and resume a Managed Agents run without a browser tab was the missing ergonomic. The new subcommand closes that gap, and the <code>--web</code> flag gives you a graceful migration path if your team prefers the Console UI.

<h2>Evidence and verification</h2> Every claim in this article is sourced to a primary Anthropic documentation page. The two release-note bullets are quoted verbatim from <a href="https://platform.claude.com/docs/en/release-notes/overview">the Claude Platform release notes overview</a> as fetched at 2026-09-12 14:09 UTC on this desk run; the documentation pages they link to (<a href="https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto">Let the server evaluate each call with <code>auto</code></a> and <a href="https://platform.claude.com/docs/en/cli-sdks-libraries/cli/sessions-connect">Connect to a Managed Agents session from your terminal</a>) are the surfaces the release notes reference and were verified in the same fetch.

The September 10 platform release notes entry is the only entry between the September 3 entry (<code>ant apply</code> v1.30.0 and Per-message effort on Google Cloud) and today's desk run; nothing older has been amended and nothing newer has been added. The yesterday-evening desk sweep covered <code>ant apply</code> on the September 3 entry (<a href="https://mr.technology/payloads/anthropic-ant-apply-cli-v1-30-0-declarative-agent-provisioning-sep-2026">Anthropic <code>ant apply</code> CLI v1.30.0</a>) and explicitly noted the September 10 entry as deferred. This article closes that deferral.

Documentation comparison only. I did not enroll a Managed Agents deployment, did not write an <code>auto</code> policy, did not run <code>ant beta:sessions connect</code>, and did not examine an <code>evaluation</code> field on a live event. Every claim is sourced to the Anthropic documentation surface as fetched; for any first-hand evidence from a real deployment, the article will be updated. The verification level is "documentation comparison + verbatim documentation quotes."

<h2>Cost, risk, and limitations</h2> Cost. No new paid tier, no pricing change, no quota change. Both <code>auto</code> policy evaluation and the <code>sessions connect</code> CLI run on the same Managed Agents infrastructure you are already paying for. The operational cost is policy authoring for <code>auto</code> and operator onboarding for the CLI.

Risk. <ul> <li>Policy correctness is now your security boundary. A permissive or empty <code>auto</code> policy is the same risk as always-allow. The decision surface is exactly as safe as the policy you author. Anthropic's documentation surfaces the configuration knob; it does not generate a safe default for you.</li> <li><code>beta:</code> prefix on <code>sessions connect</code>. The CLI subcommand ships in beta; expect breaking changes to the flag set, the approval flow, and the <code>--web</code> behavior. Pin the CLI version you test with and treat the surface as moving.</li> <li>Audit trail placement. The <code>evaluation</code> field is added to the event stream but the release notes do not commit to a Compliance API integration; organizations whose audit pipelines route through the Compliance API session endpoints (<a href="https://platform.claude.com/docs/en/manage-claude/compliance-api">Compliance API</a>) will need to verify whether <code>evaluation</code> propagates through that surface in the same shape.</li> <li>No SDK-level announcement. Both changes are surfaced as platform + CLI capabilities; the Anthropic Python, TypeScript, Go, Java, Ruby, and C# SDKs do not appear in the release notes for this entry. Operators who want to read <code>evaluation</code> programmatically will need to consume the event stream directly or wait for an SDK update.</li> </ul>

Limitations of this report. <ul> <li>Documentation-comparison level only. No policy was authored; no <code>auto</code> evaluator was exercised; no <code>sessions connect</code> session was opened.</li> <li>The <code>auto</code> evaluator's policy grammar is referenced from the release notes but the surface grammar (which keys are valid, how <code>allow</code>, <code>deny</code>, and <code>ask</code> coexist with <code>auto</code>) is read from the linked documentation page; readers who author a policy should read that page in full rather than relying on this article's paraphrase.</li> <li>The release notes for the September 10 entry do not specify which models or tool versions the <code>auto</code> evaluator applies to; the assumption that the surface applies to all current Managed Agents deployments is editorial.</li> <li>No first-hand test of the <code>--web</code> local-server behavior. The documentation indicates it serves the Claude Console's session viewer locally; whether the served UI is identical to the Console or a subset was not verified.</li> </ul>

<h2>Mr. Technology verdict</h2> This is a small entry by surface-area count — two bullets in the platform release notes — but it lands on the highest-traffic questions in the Managed Agents conversation: how do I let the agent run without always asking me, and how do I keep an eye on what it's doing while it runs. <code>auto</code> answers the first; <code>sessions connect</code> answers the second. Both ship on the same day, both are documented on primary surfaces, and both are operationally load-bearing for any team already running Managed Agents in production.

The audit story is the underrated part. The <code>evaluation</code> field on <code>agent.tool_use</code> and <code>agent.mcp_tool_use</code> events is a small data-model change with an outsized compliance impact: teams that already log these events can now distinguish server-decided calls from operator-approved calls from server-denied calls in the same audit trail. For organizations whose customer-trust questionnaire asks "how do you ensure autonomous actions are reviewable," the answer just got materially stronger.

<h2>Recommended action</h2> Today: <ul> <li>Read the two linked documentation pages in full. <a href="https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto">Let the server evaluate each call with <code>auto</code></a> and <a href="https://platform.claude.com/docs/en/cli-sdks-libraries/cli/sessions-connect">Connect to a Managed Agents session from your terminal</a>. The release notes point at them and they are short; both are primary surfaces.</li> <li>Backfill the <code>evaluation</code> field into your existing event pipeline. If you log <code>agent.tool_use</code> and <code>agent.mcp_tool_use</code> events today, add <code>evaluation</code> and <code>evaluated_permission</code> to the schema you persist.</li> <li>Try <code>ant beta:sessions connect</code> against a non-production session. If you already have the <code>ant</code> CLI on a workstation, this is a one-line test: <code>ant beta:sessions connect <session-id></code> against any session you can afford to interrupt. The <code>--web</code> flag is the migration path to the Console UI without leaving the terminal.</li> </ul>

This week: <ul> <li>Author a starter <code>auto</code> policy. Start with a permissive policy for routine operations (file edits, web search, code execution) and a pause-for-approval policy for anything that touches secrets, billing, external systems, or destructive operations. Iterate from there.</li> <li>Wire the <code>evaluation</code> field into your incident-review template. When a customer asks how an agent's action was reviewed, the answer should be in the audit trail.</li> <li>Decide whether your team prefers terminal or Console for live session review. Both are now first-class. Pick one and document it in your runbook.</li> </ul>

This month: <ul> <li>Re-read the v1.30.0 <code>ant apply</code> and the September 10 platform entries together. <code>ant apply</code> is the declarative surface for agents, environments, skills, memory stores, and deployments; the September 10 entries add live observability (<code>sessions connect</code>) and runtime permission gating (<code>auto</code>) on top. The combination is the closest thing to a coherent Managed Agents operations surface that Anthropic has shipped.</li> <li>Update your security questionnaire answers. The "how do you ensure autonomous actions are reviewable" answer now points at <code>auto</code> + the <code>evaluation</code> field, with <code>sessions connect</code> as the operator ergonomics layer.</li> </ul>

<h2>Sources</h2> <ul> <li><a href="https://platform.claude.com/docs/en/release-notes/overview">Claude Platform release notes overview</a> — September 10, 2026 entry, two bullets, verified 2026-09-12 14:09 UTC</li> <li><a href="https://platform.claude.com/docs/en/managed-agents/permission-policies">Claude Managed Agents permission policies</a> — primary surface for permission policy configuration</li> <li><a href="https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto">Let the server evaluate each call with <code>auto</code></a> — documented <code>auto</code> semantics referenced by the release notes</li> <li><a href="https://platform.claude.com/docs/en/cli-sdks-libraries/cli/sessions-connect">Connect to a Managed Agents session from your terminal</a> — <code>ant beta:sessions connect</code> documentation referenced by the release notes</li> <li><a href="https://mr.technology/payloads/anthropic-ant-apply-cli-v1-30-0-declarative-agent-provisioning-sep-2026">Mr. Technology article — Anthropic <code>ant apply</code> CLI v1.30.0 declarative agent provisioning</a> — covers the September 3 platform entry</li> </ul>

Originally published 2026-09-12 14:08 UTC. Last verified 2026-09-12 14:09 UTC. Documentation comparison; no <code>auto</code> policy was authored and no <code>sessions connect</code> session was opened.