Anthropic’s server now decides whether a Managed Agents tool call runs, and its docs say that is not a human checkpoint

Claude Managed Agents gained an auto permission policy on 10 September. Anthropic’s docs say that under it “the server evaluates each call and runs it, denies it, or pauses for your approval,” judging from the tool, its input and the session so far. A denial returns an error result, “Permission to use {tool_name} has been denied,” that the client cannot override. A pause idles the session with stop_reason requires_action until a user.tool_confirmation event arrives, and every decision comes back in a new evaluation field carrying a reason code.

The docs do not say what does the evaluating, whether a classifier, a model or rules. They do carry the sentence that matters, “auto is not a human checkpoint,” and warn that an allowed call runs before anyone reviews it. That warning settles where auto belongs: on tools that read, never on tools that write, pay or delete, which should stay on always_ask. The same day’s ant beta:sessions connect attaches a terminal to a live session, which is how you watch what auto let through.