Your Agent Has Permissions. Does It Have Principles?

On April 8, 2026, Anthropic launched Claude Managed Agents: a full production platform for deploying autonomous AI agents at scale. Secure sandboxing. Long-running sessions that persist for hours, even through disconnections. Multi-agent coordination where one agent spins up others to parallelize complex work. Self-evaluation loops where the agent iterates until success criteria are met.

This is a genuine infrastructure achievement. Months of custom plumbing, reduced to API calls. Teams that needed half a year to ship a production agent can now do it in days.

But there is a layer missing.

Permissions are not principles

Managed Agents provides two permission modes for tool execution: always_allow and always_ask. The first lets the agent act freely. The second pauses and waits for human confirmation before proceeding.

This is access control. It answers the question: is this agent authorized to use this tool?

It does not answer: should this agent take this action, given these values, in this context, affecting these stakeholders?

The difference matters when agents run autonomously for hours. A multi-hour session involves hundreds of micro-decisions. Each tool call, each file written, each command executed is a judgment call. Permission scoping tells the agent what it can do. Nothing in the current architecture tells it what it ought to do.

The autonomy escalation

Consider the trajectory. The original Claude API was prompt-response: a human sends a message, gets an answer, decides what to do next. Human oversight at every turn.

Managed Agents removes that constraint. The agent runs. It calls tools. It evaluates its own work against success criteria. It spawns sub-agents to parallelize. The human who started the session may have disconnected hours ago.

This is not a criticism. Autonomous agents are genuinely useful, and the infrastructure to run them safely is hard to build. Anthropic has done real engineering work here. But the shift from conversational to autonomous changes the governance requirements fundamentally.

In a prompt-response flow, the human is the value layer. Their judgment filters every action.

In an autonomous session, that filter is gone. Unless something replaces it.

What the missing layer looks like

The gap is between access control and value alignment. We need a system that can answer, at the speed of tool execution, whether a proposed action aligns with a set of commitments that the deploying organization has made.

Not "does this agent have permission to write files?" but "does writing this particular file, with this content, in this context, respect the principles this organization committed to?"

Not "can this agent run shell commands?" but "is this specific command consistent with the data stewardship commitments we made to our users?"

This is what a constitutional governance layer provides. A creed: a set of principles that the agent evaluates against before acting. Not hardcoded rules, but constitutional reasoning applied to each decision in context.

Three integration patterns

Working with the Managed Agents API, we have identified three concrete points where constitutional governance can be wired in.

Pattern 1: The agent asks. A custom tool gives the agent the ability to check a proposed action against the active creed before executing it. The agent describes what it intends to do, who is affected, and whether it is reversible. The governance layer returns a verdict with constitutional reasoning. The agent adapts.

This pattern is agent-initiated. It relies on the agent choosing to check. It works when the system prompt establishes the expectation, and it has the advantage of being context-rich: the agent explains why it wants to act, not just what it wants to do.

Pattern 2: The guardrail checks. Sensitive tools are configured to pause before execution. A middleware layer intercepts the pending tool call, evaluates it against the creed, and responds with allow or deny, including constitutional reasoning in the denial message. The agent cannot bypass this layer.

This pattern is mandatory. It catches every sensitive action regardless of whether the agent thought to check. It adds latency to each gated tool call, but for high-stakes operations, the latency is the feature: it means someone considered the implications before proceeding.

Pattern 3: The rubric evaluates. Managed Agents includes an outcomes system where a separate grader evaluates the agent's entire body of work against a rubric. A creed is a rubric. Upload it, and the grader, running in its own context window, immune to the working agent's reasoning, evaluates the output against constitutional principles.

This pattern is holistic. It does not gate individual actions; it evaluates the whole. And because the grader runs independently, it cannot be influenced by the working agent's sunk-cost reasoning.

From allow/deny to graduated response

Binary permission gates are blunt instruments. An operation that reads a directory listing carries different risk from one that deletes a database table. Treating both with the same allow/deny gate produces either false positives (blocking safe operations) or false negatives (waving through dangerous ones).

Constitutional evaluation supports graduated response. A risk score from 1 (clearly benign) to 5 (clearly harmful) allows the governance layer to:

• Allow low-risk actions silently (risk 1-2)
• Allow moderate-risk actions with audit logging (risk 3)
• Deny high-risk actions with constitutional reasoning (risk 4-5)

This eliminates the frustration of over-blocking while maintaining safety on operations that matter. The agent can list directories, run build tools, and write source files without friction. When it tries to delete data, modify system files, or execute untrusted code, the creed intervenes.

Multi-agent propagation

The hardest problem in the Managed Agents architecture is multi-agent coordination. An orchestrator agent spawns sub-agents. Each sub-agent inherits the orchestrator's tool permissions. But does it inherit the orchestrator's understanding of why the work matters? Its awareness of affected stakeholders? The relational context that shapes judgment?

Permissions propagate automatically. Values do not. The sub-agent has the tools and the task but not the relationship.

Constitutional governance addresses this through creed propagation: each sub-agent operates under the same constitutional framework as the orchestrator. The creed travels with the session, not just the permissions. When a sub-agent faces a judgment call, it evaluates against the same principles, regardless of how many delegation boundaries it has crossed.

The scaling argument

Managed Agents offers always_allow and always_ask. The first does not scale down: it provides no oversight. The second does not scale up: it requires a human to confirm every sensitive action, which defeats the purpose of autonomous execution.

Constitutional governance introduces a third option. The human defines values once, as a creed. The creed applies those values at scale, across hundreds of autonomous decisions, without requiring the human to approve each one.

The human's role shifts from per-action approval to per-deployment alignment: define what matters, express it as principles, and let the governance layer apply those principles consistently.

This is what "guardrails" should mean when we talk about autonomous agents. Not just "what tools can it access?" but "what values guide its judgment?"

The window is now

Industry standards for agent governance are being set right now. If "guardrails" comes to mean "permission scoping and rate limits" in the collective understanding, that becomes the ceiling. Every agent platform will implement access control and call it governance.

The alternative is to demonstrate, with working code and production deployments, that guardrails should mean constitutional evaluation. That agents operating on our behalf should be accountable to principles we define, not just permissions we configure.

The infrastructure layer is here. The missing layer is the one that makes the infrastructure trustworthy.