permission-policies changedmanaged-agents/permission-policies
Nearest release: v2.1.323, published 4 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+62added
Lines−58removed
From line
37
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits29to this page, all time
The whole hunk
from line 37, old and new numbered
/
from line 37
3737 Claude Models on Google Cloud (Anthropic managed): beta
3838---
3939
40Permission policies control whether server-executed tools (the pre-built agent toolset and MCP toolset) run automatically, wait for your approval, or have each call evaluated by the server. Custom tools are run by your application and controlled by you, so they are not governed by permission policies.
40Permission policies apply to server-executed tools: the prebuilt agent toolset and MCP toolsets. A policy determines whether a tool’s calls run automatically, wait for your approval, or go to the server, which evaluates each call. Custom tools run in your application, under your control, so permission policies don’t apply to custom tools.
4141
4242## Permission policy types
4343
from line 655
655655 ```
656656</CodeGroup>
657657
658Pass this `tools` (csharp, go: `Tools`) configuration in the agent create request (the CLI tab shows the complete command). MCP toolsets support the same per-tool overrides, with `name` (csharp, go: `Name`) set to the tool name reported by the MCP server. See [Configure which MCP tools are available](https://platform.claude.com/docs/en/managed-agents/mcp-connector#configure-which-mcp-tools-are-available).
658Pass this `tools` (csharp, go: `Tools`) configuration when you create the agent. MCP toolsets support the same per-tool overrides, with `name` (csharp, go: `Name`) set to the tool name reported by the MCP server. See [Configure which MCP tools are available](https://platform.claude.com/docs/en/managed-agents/mcp-connector#configure-which-mcp-tools-are-available).
659659
660660## Let the server evaluate each call with `auto`
661661
from line 665
665665* **The call is denied.** When the server evaluates the call as high-risk, the tool does not run. The agent receives an error tool result with the content `Permission to use {tool_name} has been denied.` and `is_error: true`. The session keeps running, and your client cannot override the denial.
666666* **The call pauses for your approval.** When the server reaches no determination, the session pauses as it does under `always_ask`. See [Respond to confirmation requests](https://platform.claude.com/docs/en/managed-agents/permission-policies#respond-to-confirmation-requests).
667667
668To turn on `auto`, set `permission_policy` to `{"type": "auto"}`. It goes in the same two places as the other policies: a toolset’s [`default_config` (java, php: `defaultConfig`; csharp, go: `DefaultConfig`)](https://platform.claude.com/docs/en/managed-agents/permission-policies#set-a-policy-for-a-toolset) for the whole toolset, or a [`configs` (csharp, go: `Configs`) entry](https://platform.claude.com/docs/en/managed-agents/permission-policies#override-an-individual-tool-policy) for one tool. The agent toolset and MCP toolsets both accept it. No toolset uses `auto` by default.
668To turn on `auto`, set `permission_policy` (java, php: `permissionPolicy`; csharp, go: `PermissionPolicy`) to `{"type": "auto"}`. It goes in the same two places as the other policies: a toolset’s [`default_config` (java, php: `defaultConfig`; csharp, go: `DefaultConfig`)](https://platform.claude.com/docs/en/managed-agents/permission-policies#set-a-policy-for-a-toolset) for the whole toolset, or a [`configs` (csharp, go: `Configs`) entry](https://platform.claude.com/docs/en/managed-agents/permission-policies#override-an-individual-tool-policy) for one tool. The agent toolset and MCP toolsets both accept it. No toolset uses `auto` by default.
669669
670670The following example sets `auto` as the default for the agent toolset and for the `github` MCP toolset, and overrides `bash` to `always_ask`:
671671
from line 1069
10691069<CodeGroup>
10701070 ```bash cURL
10711071 # Allow the tool to run
1072 curl -fsSL "https://api.anthropic.com/v1/sessions/$SESSION_ID/events" \
1072 curl -fsSL https://api.anthropic.com/v1/sessions/sesn_011CZkZAtmR3yMPDzynEDxu7/events \
10731073 -H "x-api-key: $ANTHROPIC_API_KEY" \
10741074 -H "anthropic-version: 2026-10-21" \
10751075 -H "anthropic-beta: managed-agents-2026-04-01" \
from line 1078
10781078 "events": [
10791079 {
10801080 "type": "user.tool_confirmation",
1081 "tool_use_id": "'$AGENT_TOOL_USE_EVENT_ID'",
1081 "tool_use_id": "sevt_011CZkZbMpR8aS3Wtv5Yq2Ln",
10821082 "result": "allow"
10831083 }
10841084 ]
10851085 }'
10861086
1087 # Or deny it with an explanation
1088 curl -fsSL "https://api.anthropic.com/v1/sessions/$SESSION_ID/events" \
1087 # Deny another call with an explanation
1088 curl -fsSL https://api.anthropic.com/v1/sessions/sesn_011CZkZAtmR3yMPDzynEDxu7/events \
10891089 -H "x-api-key: $ANTHROPIC_API_KEY" \
10901090 -H "anthropic-version: 2026-10-21" \
10911091 -H "anthropic-beta: managed-agents-2026-04-01" \
from line 1094
10941094 "events": [
10951095 {
10961096 "type": "user.tool_confirmation",
1097 "tool_use_id": "'$MCP_TOOL_USE_EVENT_ID'",
1097 "tool_use_id": "sevt_011CZkZcNqT9bT4Xuw6Zr3Mo",
10981098 "result": "deny",
1099 "deny_message": "Don'\''t create issues in the production project. Use the staging project."
1099 "deny_message": "Do not create issues in the production project. Use the staging project."
11001100 }
11011101 ]
11021102 }'
from line 1105
11051105 ```bash CLI
11061106 # Allow the tool to run
11071107 ant beta:sessions:events send \
1108 --session-id "$SESSION_ID" \
1109 --event "{type: user.tool_confirmation, tool_use_id: $AGENT_TOOL_USE_EVENT_ID, result: allow}"
1108 --session-id sesn_011CZkZAtmR3yMPDzynEDxu7 \
1109 --event '{type: user.tool_confirmation, tool_use_id: sevt_011CZkZbMpR8aS3Wtv5Yq2Ln, result: allow}'
11101110
1111 # Or deny it with an explanation
1111 # Deny another call with an explanation
11121112 ant beta:sessions:events send \
1113 --session-id "$SESSION_ID" \
1114 --event "{type: user.tool_confirmation, tool_use_id: $MCP_TOOL_USE_EVENT_ID, result: deny,
1115 deny_message: Don't create issues in the production project. Use the staging project.}"
1113 --session-id sesn_011CZkZAtmR3yMPDzynEDxu7 \
1114 --event '{type: user.tool_confirmation, tool_use_id: sevt_011CZkZcNqT9bT4Xuw6Zr3Mo, result: deny, deny_message: "Do not create issues in the production project. Use the staging project."}'
11161115 ```
11171116
11181117 ```python Python
11191118 # Allow the tool to run
11201119 client.beta.sessions.events.send(
1121 session.id,
1120 "sesn_011CZkZAtmR3yMPDzynEDxu7",
11221121 events=[
11231122 {
11241123 "type": "user.tool_confirmation",
1125 "tool_use_id": agent_tool_use_event.id,
1124 "tool_use_id": "sevt_011CZkZbMpR8aS3Wtv5Yq2Ln",
11261125 "result": "allow",
11271126 },
11281127 ],
11291128 )
11301129
1131 # Or deny it with an explanation
1130 # Deny another call with an explanation
11321131 client.beta.sessions.events.send(
1133 session.id,
1132 "sesn_011CZkZAtmR3yMPDzynEDxu7",
11341133 events=[
11351134 {
11361135 "type": "user.tool_confirmation",
1137 "tool_use_id": mcp_tool_use_event.id,
1136 "tool_use_id": "sevt_011CZkZcNqT9bT4Xuw6Zr3Mo",
11381137 "result": "deny",
1139 "deny_message": "Don't create issues in the production project. Use the staging project.",
1138 "deny_message": "Do not create issues in the production project. Use the staging project.",
11401139 },
11411140 ],
11421141 )
from line 1143
11441143
11451144 ```typescript TypeScript
11461145 // Allow the tool to run
1147 await client.beta.sessions.events.send(session.id, {
1146 await client.beta.sessions.events.send("sesn_011CZkZAtmR3yMPDzynEDxu7", {
11481147 events: [
11491148 {
11501149 type: "user.tool_confirmation",
1151 tool_use_id: agent_tool_use_event.id,
1150 tool_use_id: "sevt_011CZkZbMpR8aS3Wtv5Yq2Ln",
11521151 result: "allow"
11531152 }
11541153 ]
11551154 });
11561155
1157 // Or deny it with an explanation
1158 await client.beta.sessions.events.send(session.id, {
1156 // Deny another call with an explanation
1157 await client.beta.sessions.events.send("sesn_011CZkZAtmR3yMPDzynEDxu7", {
11591158 events: [
11601159 {
11611160 type: "user.tool_confirmation",
1162 tool_use_id: mcp_tool_use_event.id,
1161 tool_use_id: "sevt_011CZkZcNqT9bT4Xuw6Zr3Mo",
11631162 result: "deny",
1164 deny_message: "Don't create issues in the production project. Use the staging project."
1163 deny_message: "Do not create issues in the production project. Use the staging project."
11651164 }
11661165 ]
11671166 });
from line 1167
11681167 ```
11691168
11701169 ```csharp C#
1170 using Anthropic.Models.Beta.Sessions.Events;
1171
11711172 // Allow the tool to run
1172 await client.Beta.Sessions.Events.Send(session.ID, new()
1173 await client.Beta.Sessions.Events.Send("sesn_011CZkZAtmR3yMPDzynEDxu7", new()
11731174 {
11741175 Events =
11751176 [
11761177 new BetaManagedAgentsUserToolConfirmationEventParams
11771178 {
1178 ToolUseID = agentToolUseEvent.ID,
1179 ToolUseID = "sevt_011CZkZbMpR8aS3Wtv5Yq2Ln",
11791180 Result = "allow",
11801181 },
11811182 ],
11821183 });
11831184
1184 // Or deny it with an explanation
1185 await client.Beta.Sessions.Events.Send(session.ID, new()
1185 // Deny another call with an explanation
1186 await client.Beta.Sessions.Events.Send("sesn_011CZkZAtmR3yMPDzynEDxu7", new()
11861187 {
11871188 Events =
11881189 [
11891190 new BetaManagedAgentsUserToolConfirmationEventParams
11901191 {
1191 ToolUseID = mcpToolUseEvent.ID,
1192 ToolUseID = "sevt_011CZkZcNqT9bT4Xuw6Zr3Mo",
11921193 Result = "deny",
1193 DenyMessage = "Don't create issues in the production project. Use the staging project.",
1194 DenyMessage = "Do not create issues in the production project. Use the staging project.",
11941195 },
11951196 ],
11961197 });
from line 1199
11981199
11991200 ```go Go
12001201 // Allow the tool to run
1201 _, err = client.Beta.Sessions.Events.Send(ctx, session.ID, anthropic.BetaSessionEventSendParams{
1202 _, err := client.Beta.Sessions.Events.Send(ctx, "sesn_011CZkZAtmR3yMPDzynEDxu7", anthropic.BetaSessionEventSendParams{
12021203 Events: []anthropic.BetaManagedAgentsEventParamsUnion{{
12031204 OfUserToolConfirmation: &anthropic.BetaManagedAgentsUserToolConfirmationEventParams{
1204 ToolUseID: agentToolUseEvent.ID,
1205 ToolUseID: "sevt_011CZkZbMpR8aS3Wtv5Yq2Ln",
12051206 Result: anthropic.BetaManagedAgentsUserToolConfirmationEventParamsResultAllow,
12061207 },
12071208 }},
from line 1211
12101211 panic(err)
12111212 }
12121213
1213 // Or deny it with an explanation
1214 _, err = client.Beta.Sessions.Events.Send(ctx, session.ID, anthropic.BetaSessionEventSendParams{
1214 // Deny another call with an explanation
1215 _, err = client.Beta.Sessions.Events.Send(ctx, "sesn_011CZkZAtmR3yMPDzynEDxu7", anthropic.BetaSessionEventSendParams{
12151216 Events: []anthropic.BetaManagedAgentsEventParamsUnion{{
12161217 OfUserToolConfirmation: &anthropic.BetaManagedAgentsUserToolConfirmationEventParams{
1217 ToolUseID: mcpToolUseEvent.ID,
1218 ToolUseID: "sevt_011CZkZcNqT9bT4Xuw6Zr3Mo",
12181219 Result: anthropic.BetaManagedAgentsUserToolConfirmationEventParamsResultDeny,
1219 DenyMessage: anthropic.String("Don't create issues in the production project. Use the staging project."),
1220 DenyMessage: anthropic.String("Do not create issues in the production project. Use the staging project."),
12201221 },
12211222 }},
12221223 })
from line 1227
12261227 ```
12271228
12281229 ```java Java
1230 import com.anthropic.models.beta.sessions.events.BetaManagedAgentsUserToolConfirmationEventParams;
1231 import com.anthropic.models.beta.sessions.events.EventSendParams;
1232
12291233 // Allow the tool to run
12301234 client.beta().sessions().events().send(
1231 session.id(),
1235 "sesn_011CZkZAtmR3yMPDzynEDxu7",
12321236 EventSendParams.builder()
12331237 .addEvent(
12341238 BetaManagedAgentsUserToolConfirmationEventParams.builder()
1235 .toolUseId(agentToolUseEvent.id())
1239 .toolUseId("sevt_011CZkZbMpR8aS3Wtv5Yq2Ln")
12361240 .result(BetaManagedAgentsUserToolConfirmationEventParams.Result.ALLOW)
12371241 .build()
12381242 )
from line 1243
12391243 .build()
12401244 );
12411245
1242 // Or deny it with an explanation
1246 // Deny another call with an explanation
12431247 client.beta().sessions().events().send(
1244 session.id(),
1248 "sesn_011CZkZAtmR3yMPDzynEDxu7",
12451249 EventSendParams.builder()
12461250 .addEvent(
12471251 BetaManagedAgentsUserToolConfirmationEventParams.builder()
1248 .toolUseId(mcpToolUseEvent.id())
1252 .toolUseId("sevt_011CZkZcNqT9bT4Xuw6Zr3Mo")
12491253 .result(BetaManagedAgentsUserToolConfirmationEventParams.Result.DENY)
1250 .denyMessage("Don't create issues in the production project. Use the staging project.")
1254 .denyMessage("Do not create issues in the production project. Use the staging project.")
12511255 .build()
12521256 )
12531257 .build()
from line 1263
12591263
12601264 // Allow the tool to run
12611265 $client->beta->sessions->events->send(
1262 $session->id,
1266 'sesn_011CZkZAtmR3yMPDzynEDxu7',
12631267 events: [
12641268 ManagedAgentsUserToolConfirmationEventParams::with(
1265 toolUseID: $agentToolUseEvent->id,
1269 toolUseID: 'sevt_011CZkZbMpR8aS3Wtv5Yq2Ln',
12661270 result: 'allow',
12671271 ),
12681272 ],
12691273 );
12701274
1271 // Or deny it with an explanation
1275 // Deny another call with an explanation
12721276 $client->beta->sessions->events->send(
1273 $session->id,
1277 'sesn_011CZkZAtmR3yMPDzynEDxu7',
12741278 events: [
12751279 ManagedAgentsUserToolConfirmationEventParams::with(
1276 toolUseID: $mcpToolUseEvent->id,
1280 toolUseID: 'sevt_011CZkZcNqT9bT4Xuw6Zr3Mo',
12771281 result: 'deny',
1278 denyMessage: "Don't create issues in the production project. Use the staging project.",
1282 denyMessage: 'Do not create issues in the production project. Use the staging project.',
12791283 ),
12801284 ],
12811285 );
from line 1288
12841288 ```ruby Ruby
12851289 # Allow the tool to run
12861290 client.beta.sessions.events.send_(
1287 session.id,
1291 "sesn_011CZkZAtmR3yMPDzynEDxu7",
12881292 events: [
12891293 {
12901294 type: "user.tool_confirmation",
1291 tool_use_id: agent_tool_use_event.id,
1295 tool_use_id: "sevt_011CZkZbMpR8aS3Wtv5Yq2Ln",
12921296 result: "allow"
12931297 }
12941298 ]
12951299 )
12961300
1297 # Or deny it with an explanation
1301 # Deny another call with an explanation
12981302 client.beta.sessions.events.send_(
1299 session.id,
1303 "sesn_011CZkZAtmR3yMPDzynEDxu7",
13001304 events: [
13011305 {
13021306 type: "user.tool_confirmation",
1303 tool_use_id: mcp_tool_use_event.id,
1307 tool_use_id: "sevt_011CZkZcNqT9bT4Xuw6Zr3Mo",
13041308 result: "deny",
1305 deny_message: "Don't create issues in the production project. Use the staging project."
1309 deny_message: "Do not create issues in the production project. Use the staging project."
13061310 }
13071311 ]
13081312 )
No line in this hunk matches that.