---
title: "Anthropic's Claude Managed Agents Now Flag Risky Actions for Human Approval"
subtitle: "Anthropic ships a live session viewer and a server-side auto permission mode for Claude Managed Agents, letting the model decide when to pause for human approval."
url: "https://alphasignal.ai/news/anthropic-s-claude-managed-agents-now-flag-risky-actions-for-human-approval"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "ClaudeDevs"
company_url: "https://alphasignal.ai/company/claudedevs"
published: "2026-09-10T18:43:15.000Z"
updated: "2026-09-11T17:47:06.653Z"
type: "News"
topics:
  - "Agents"
  - "Development"
subtopics:
  - "Agent Frameworks"
  - "Tool Use"
  - "Computer Use"
upvotes: 1511
read_time: "4 min"
source_url: "https://x.com/claudedevs/status/2098120133549895978"
comments: 0
---

# Anthropic's Claude Managed Agents Now Flag Risky Actions for Human Approval

> Anthropic ships a live session viewer and a server-side auto permission mode for Claude Managed Agents, letting the model decide when to pause for human approval.

Anthropic has tightened the supervision loop for [Claude Managed Agents](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/apply). Developers can now attach a terminal or browser to a running agent, while a server-side permission mode evaluates each tool call and escalates selected actions for human approval.

## Two controls, one supervision loop

- `ant beta:sessions connect` opens a live session for monitoring, messaging, and approval decisions.
- `permission_policy.mode = auto` classifies tool calls as `run`, `deny`, or `pending_approval`.

## Attach to work in flight

Managed Agents is Anthropic’s hosted runtime for agent loops. Developers define an agent, configure a cloud container with packages and network rules, start a session, and receive incremental results through server-sent events, or SSE. Previously, teams needed custom tooling to turn that event stream into a live operational view.

The CLI can now connect directly to an active session:

```
ant beta:sessions connect <session-id>

# Open the Console session viewer in a browser
ant beta:sessions connect <session-id> --web
```

An attached operator can follow events as they arrive, send messages into the session, and approve or reject waiting tool calls. The `--web` option opens the graphical Claude Console session viewer through `localhost`.

## Permission decisions gain context

Static permission policies rely on allowlists and denylists defined before a session starts. The new `auto` mode evaluates each `agent.tool_use` and `agent.mcp_tool_use` event on the server. MCP refers to Model Context Protocol tools, which let agents call external services and data sources.

The evaluator uses the intent expressed in `user.message` events to choose one of three outcomes:

- `run`: allow the tool call to proceed.
- `deny`: block the tool call.
- `pending_approval`: pause until an operator approves or rejects it.

The minimal agent configuration is:

```
{
  "agent": {
    "permission_policy": {
      "mode": "auto"
    }
  }
}
```

Tool-event payloads gain an `evaluation` field alongside `evaluated_permission`. The new field exposes the decision and a short explanation, such as `potentially destructive operation`. Consumers that accept additional properties can read the richer signal immediately, while strict schema validators must add the field before enabling the mode.

## Why broad rules misfire

Broad tool permissions lose the distinction between safe and risky uses of the same capability. A blanket denial for `shell_exec`, for example, blocks both a harmless directory listing and a destructive filesystem command. Enumerating every acceptable shell command creates a large policy surface that still misses novel cases.

Per-call evaluation lets the server consider the requested action and the user’s stated intent together. Routine reads and lookups can proceed, clearly disallowed actions can stop, and uncertain or consequential operations can wait for review.

## When a call needs a human

1. Start a session with `permission_policy.mode` set to `auto`.
2. Let the server evaluate each native or MCP tool call.
3. Allow routine calls to continue and denied calls to stop.
4. Leave escalated calls in `pending_approval`.
5. Connect with `ant beta:sessions connect` and approve or reject the waiting action.

## Idle time and the bill

At publication, Managed Agents sessions cost $0.08 per hour, billed to the millisecond, plus standard Claude token rates. Anthropic does not charge for idle time. Approval pauses therefore avoid session-time charges while the session remains idle, although token usage already incurred remains billable.

The `ant` CLI follows a resource-based command structure:

```
ant [resource] <command> [flags]
```

Teams can now use the same operational surface to apply agent and environment configurations, inspect live execution, send follow-up instructions, and resolve approval requests.

## Beta edges to account for

- The connection command uses the `beta:` namespace, and both capabilities depend on the Managed Agents beta API surface. Commands, headers, and payloads may change.
- Automatic evaluation is model-based. Ambiguous `user.message` events can produce unnecessary pauses or incorrect classifications, so prompts should state intended actions and boundaries explicitly.
- Strict event schemas must accept the new `evaluation` field before production rollout.
- Container permissions, credentials, and network restrictions still define the consequences of an approved call. Least-privilege environments remain necessary.

The combined update reduces custom supervision plumbing: routine calls continue, denied calls stop, and approval cases wait in a standard terminal or browser interface.

## Sources

- [ClaudeDevs announcement on X](https://x.com/claudedevs/status/2098120133549895978)
- [Claude Managed Agentsに権限自動判定「auto」追加、ant CLIでセッション接続も可能に](https://qiita.com/picnic/items/85222ea4e7e845e4523f)
- [Manage resources as code with ant apply - Claude Platform Docs](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/apply)
- [Getting Started with the ant CLI: Deploy Claude Agents](https://avinashsangle.com/blog/ant-cli-getting-started)
- [2026-04-09 – Claude Managed Agents & the ant CLI](https://claudebeat.ai/articles/2026/04/2026-04-09.html)