Claude Managed Agents adds live connections and automatic permissions

Anthropic has tightened the supervision loop for Claude Managed Agents. Developers can now attach a terminal or browser to a running agent, while a server-side permission mode evaluates each tool call and escalates selected actions for human approval.

Two controls, one supervision loop

• ant beta:sessions connect opens a live session for monitoring, messaging, and approval decisions.
• permission_policy.mode = auto classifies tool calls as run, deny, or pending_approval.

Attach to work in flight

Managed Agents is Anthropic’s hosted runtime for agent loops. Developers define an agent, configure a cloud container with packages and network rules, start a session, and receive incremental results through server-sent events, or SSE. Previously, teams needed custom tooling to turn that event stream into a live operational view.

The CLI can now connect directly to an active session:

ant beta:sessions connect <session-id>

# Open the Console session viewer in a browser
ant beta:sessions connect <session-id> --web

An attached operator can follow events as they arrive, send messages into the session, and approve or reject waiting tool calls. The --web option opens the graphical Claude Console session viewer through localhost.

Permission decisions gain context

Static permission policies rely on allowlists and denylists defined before a session starts. The new auto mode evaluates each agent.tool_use and agent.mcp_tool_use event on the server. MCP refers to Model Context Protocol tools, which let agents call external services and data sources.

The evaluator uses the intent expressed in user.message events to choose one of three outcomes:

• run: allow the tool call to proceed.
• deny: block the tool call.
• pending_approval: pause until an operator approves or rejects it.

The minimal agent configuration is:

{
  "agent": {
    "permission_policy": {
      "mode": "auto"
    }
  }
}

Tool-event payloads gain an evaluation field alongside evaluated_permission. The new field exposes the decision and a short explanation, such as potentially destructive operation. Consumers that accept additional properties can read the richer signal immediately, while strict schema validators must add the field before enabling the mode.

Why broad rules misfire

Broad tool permissions lose the distinction between safe and risky uses of the same capability. A blanket denial for shell_exec, for example, blocks both a harmless directory listing and a destructive filesystem command. Enumerating every acceptable shell command creates a large policy surface that still misses novel cases.

Per-call evaluation lets the server consider the requested action and the user’s stated intent together. Routine reads and lookups can proceed, clearly disallowed actions can stop, and uncertain or consequential operations can wait for review.

When a call needs a human

1. Start a session with permission_policy.mode set to auto.
2. Let the server evaluate each native or MCP tool call.
3. Allow routine calls to continue and denied calls to stop.
4. Leave escalated calls in pending_approval.
5. Connect with ant beta:sessions connect and approve or reject the waiting action.

Idle time and the bill

At publication, Managed Agents sessions cost $0.08 per hour, billed to the millisecond, plus standard Claude token rates. Anthropic does not charge for idle time. Approval pauses therefore avoid session-time charges while the session remains idle, although token usage already incurred remains billable.

The ant CLI follows a resource-based command structure:

ant [resource] <command> [flags]

Teams can now use the same operational surface to apply agent and environment configurations, inspect live execution, send follow-up instructions, and resolve approval requests.

Beta edges to account for

• The connection command uses the beta: namespace, and both capabilities depend on the Managed Agents beta API surface. Commands, headers, and payloads may change.
• Automatic evaluation is model-based. Ambiguous user.message events can produce unnecessary pauses or incorrect classifications, so prompts should state intended actions and boundaries explicitly.
• Strict event schemas must accept the new evaluation field before production rollout.
• Container permissions, credentials, and network restrictions still define the consequences of an approved call. Least-privilege environments remain necessary.

The combined update reduces custom supervision plumbing: routine calls continue, denied calls stop, and approval cases wait in a standard terminal or browser interface.