Claude Managed Agents auto permission and Sume paid MCP calls

Claude Managed Agents' auto permission policy has the server evaluate each agent or MCP tool call and run it, deny it, or pause for approval. Sume cannot tell the policy a call is paid, because there is no mcp:paid scope, so put the limits on the Sume side: a read-only session where no spend is wanted, dry_run for previews and max_spend_usd as a per-call cap.

Vendor facts are from the Claude release notes read 2026-10-01; Sume facts from OAuth and API keys and tools and gates.

What does auto do?

The September 10, 2026 note says permission policies now include auto: "the server evaluates each agent or MCP tool call and runs it, denies it, or pauses for your approval." agent.tool_use and agent.mcp_tool_use events report how each call was evaluated in an evaluation field alongside evaluated_permission. The notes do not say what criteria the evaluation uses, so do not assume it understands cost.

What does Sume enforce on its own?

Sume's gates are independent of the client's permission policy.

How should I combine them?

Decide first whether this agent should spend at all. If not, connect with OAuth mcp:read only and a paid tool will not even be listed. If it should, give it write access and instruct it to call with dry_run first and always pass max_spend_usd, because the cap is not applied when omitted. Treat an auto allow as "the policy saw no problem", not "Sume approved the spend". Related client-side guards: Claude Code auto mode.

How do I audit it afterwards?

Use the agent.mcp_tool_use events for what the policy decided, and read the Sume job ids in the tool results for what was submitted. If a call retried, the same idempotency_key returns the original rather than billing again, so keep keys stable per intended generation.