Anthropic's New Auto Tool Permission Is Not a Human Checkpoint, and It Says So

September 14, 2026. On 10 September Anthropic added a third way to decide whether an AI agent's tool call is allowed to run, and then published two warnings about it that anyone deploying an agent for a client should read before switching it on. The feature is a permission policy called auto, where the server evaluates each agent or MCP tool call and, in Anthropic's words, "runs it, denies it, or pauses for your approval." The first warning is that this is not a human review step. The second is that a customer talking to your agent can influence what the server decides to allow.

What changed on 10 September

1. A new policy, not a new default. Managed Agents permission policies now include auto alongside the existing always_allow and always_ask. Anthropic's documentation is explicit that "no toolset uses auto by default," and that the agent toolset still defaults to always_allow while MCP toolsets default to always_ask. Nothing changes in an existing deployment unless you set it.
2. Decisions are now reported. The agent.tool_use and agent.mcp_tool_use events carry an evaluation field alongside evaluated_permission, so you can see how each call was judged rather than only what it did.
3. A way to watch a live session. The ant CLI adds ant beta:sessions connect, which attaches a terminal to a running session so you can follow it, send messages, and allow or deny tool calls waiting for approval. Passing --web serves the console session viewer locally instead.

The first warning: automatic is not supervised

The documentation states it directly. "auto is not a human checkpoint. If the server determines that a call is safe, the call runs before anyone sees it, and its effects might not be reversible." That sentence is doing real work. A safe looking call that sends an email, updates a CRM record or charges a card is not undone by noticing it afterwards in an event log. The denial side is equally firm: a server denial cannot be appealed from your side, your client cannot override it, and sending a confirmation for a call the server already denied returns an error.

The second warning: your customer's words count as your intent

This is the one that matters for anyone building a customer facing agent. Anthropic's guidance reads: "If you relay untrusted end-user input in user.message events, the server reads that input as your intent too, and it can get a call allowed. Configure always_ask on the tools you would not let that end user run without review."

Read that as an architectural instruction rather than a caution. The moment a stranger's typing reaches the agent through the same channel your own instructions use, the server cannot tell the two apart, and the evaluation it performs is being fed by someone who does not work for you. The remedy Anthropic names is not better filtering. It is choosing a stricter policy per tool, which means the permission decision has to be made tool by tool, on the basis of who can reach the agent, before anything is deployed.

What it means for operators

If you run agents on behalf of clients, the useful output of this release is a short classification exercise. Split every tool your agent can reach into two lists: the ones whose worst outcome is a wasted API call, and the ones that move money, send a message to a third party, or write to a system of record. The first list is a reasonable candidate for auto. The second belongs on always_ask for as long as untrusted input can reach the agent, which for any customer facing deployment is permanently.

Outbound email is the clearest example of the second category, because a wrongly sent message cannot be recalled and the cost lands on a sending domain you spent months warming. That is worth weighing against the email infrastructure you already depend on, since an agent with unsupervised send access is a deliverability risk before it is a security one. The same logic applies across the AI automation builds we scope: the permission model is part of the specification, not a setting somebody flips during handover.

For the first week of any new agent, the session attach command is the cheapest supervision available. Watching a live session and approving calls by hand is slow, and it is how you learn which tools actually get called often enough to justify automatic evaluation.