Anthropic shipped ant apply on 3 September 2026, in ant CLI version 1.30.0, and it changes how you're meant to manage a Claude-based agent once it's no longer just running on your laptop: agents, environments, skills, memory stores and deployments now get defined as files, applied against a target, diffed against what's actually deployed, and locked to a claude-lock.json file for reproducible deploys across machines and CI.
A week later, on 10 September, Claude Managed Agents gained a second, related piece: an auto permission-evaluation mode, where the server itself evaluates each agent or MCP tool call against policy and can run it, deny it, or pause it for a human to approve — instead of relying entirely on rules a human configured and trusted on the client side.
What ant apply actually gives you
If you've worked with Terraform, or any infrastructure-as-code tool, the shape will be familiar: you write down what an agent's configuration should be — its environment, the skills it has access to, its memory store, where it deploys — in files that live in version control. ant apply then compares that declared state against what's actually running and produces a plan: what would change, what would be created, what would be removed. You can diff before you apply. The output is a claude-lock.json lockfile that pins the exact resolved configuration, so a second machine or a CI pipeline running ant apply against the same files reproduces the same deployed state rather than whatever happened to be latest at the time.
That distinction matters more than it sounds. Without a lockfile, "redeploy the agent" on a teammate's machine, or from CI a week later, can quietly diverge from what's running in production — a different skill version, a different memory store, a different environment variable resolved differently. That's drift, and it's the same category of problem infrastructure-as-code tools solved for servers years ago, now showing up for agents.
The permission change is a bigger deal than it sounds
Client-side permission rules — the kind you configure once and trust to hold — are exactly the sort of thing that can have the kind of bypass bugs Claude Code itself patched this same week. The new auto mode for Claude Managed Agents moves the evaluation itself onto the server: each agent or MCP tool call gets checked against policy at the point of the call, with three outcomes — run, deny, or pause for a human to approve — rather than a human having to have anticipated and correctly configured every case in advance on the client.
For a small team, the practical effect is that an agent making a tool call nobody is actively watching now has a real backstop. A rule you forgot to write, or wrote wrong, doesn't silently fail open the way a misconfigured client-side deny-rule can; instead an unclear case gets paused for approval rather than executed. That's a materially safer default posture for anything running unattended.
What this enables concretely
Together, the two changes let a small team treat agent configuration the way it already treats infrastructure: version-controlled, diffable before it's applied, and reproducible across environments rather than hand-configured per machine. That means you can catch drift between a staging agent and a production agent by running a diff instead of noticing behavioural differences after the fact. It means a new team member, or a CI job, can stand up the same agent configuration from the same files and get the same locked result, rather than something subtly different depending on when they ran it. And it means the permission question for unattended agent calls shifts from "did someone configure the client rules correctly" to "does the server-side policy correctly categorise run, deny and pause," which is a narrower, more auditable question.
What to actually try this week
If you're running Claude-based agents beyond a single developer's laptop, start by putting your existing agent configuration into files and running ant apply with a diff or dry-run flag against your current production deployment before applying anything — the diff alone will likely surface at least one piece of drift you didn't know about. Commit the resulting claude-lock.json alongside your configuration files so a teammate or a CI job can reproduce the exact deployed state rather than re-resolving it fresh. Separately, if you have Managed Agents making MCP tool calls without a human watching each one, turn on auto permission-evaluation mode and spend an afternoon reviewing what gets paused for approval in the first few days — that list is the fastest way to find out where your policy is under-specified.
The bottom line
Anthropic's ant apply, shipped 3 September 2026 in ant CLI 1.30.0, brings version-controlled, diffable, lockfile-reproducible deploys to Claude agents, and the new server-side auto permission mode for Managed Agents, added 10 September, gives unattended tool calls a real run/deny/pause backstop instead of client-side rules alone. If you're running agents past one laptop, put your configuration in files and run a diff against production this week.