Claude Fable 5.2 tightens history checks: Revoke tools safely

An agent has a queued request to send a document. An administrator removes its sending permission. Your application deletes the tool from the next API request, but that request now fails before Claude can respond.

Anthropic's November 9, 2026 release makes Claude Fable 5.2 enforce conversation-prefix checks for every account. Replaying its thinking after changing the earlier system prompt, tools, or messages can return a 400 error. Older accounts could previously miss this problem on Fable 5.1.

Keep the sending permission revoked while repairing the conversation. Deny execution first, then append the change to the history Claude receives. Restoring the old permission just to make a request pass would undo the administrator's decision.

This procedure covers application-executed tools on the direct Claude Messages API. Anthropic says its own conversation management in Claude Code, claude.ai, Managed Agents, and the Agent SDK already handles history preservation; the migration work concerns code that constructs or rewrites history itself. Migration scope. The document-sending example is hypothetical, and the acceptance checks below are recommendations, not results from a live integration.

Revoke at the executor before repairing history#

With a client tool, Claude requests an operation and your application executes it. The application then returns a tool_result associated with the original tool_use_id. Client-tool handling.

Use that execution boundary to enforce current permission. In the example, the sending service should reject the pending document delivery even if the request was generated before the administrator revoked access. An old model response or previously granted approval must not bypass the current policy.

Our recommended transition is:

1. Commit the new permission decision in the authoritative policy store. Stop new dispatches for the affected operation.
2. Identify queued and already dispatched calls. Deny queued calls under the new policy; check the destination for operations that may already have happened.
3. Persist an append-only model update and its policy revision with the conversation.
4. Resume only the work that remains authorized.

Make the policy check and dispatch ordering explicit. A worker that checks permission, waits, and sends after another worker commits the revocation creates a race. Use serialization or an equivalent mechanism that gives the transition a defined order. Already accepted downstream operations need their own cancellation or reconciliation procedure.

The coding-agent security baseline covers the surrounding credential and execution boundaries.

Append the removal instead of deleting the definition#

Anthropic's mid-conversation tool-change beta lets the application withdraw a declared tool using tool_removal. On the direct Claude API, send inline-tools-2026-09-15. Keep the original top-level tool definition and earlier messages unchanged.

Below is an illustrative message to append after a valid user turn, including a turn containing completed tool results. send_document is an invented client tool already declared in the request. This is a message fragment, not a complete API request.

Code source: illustrative; block fields follow the mid-conversation tool reference.

Do not insert this between a tool_use and its tool_result. For a denied client call, return an error result for that call before appending the removal. Tool changes also cannot immediately follow a paused assistant turn ending in a server-tool result. Keep execution denied while resolving the valid continuation point. Do not resume sensitive server-side work merely to reach one.

Construct system messages from trusted application decisions. Retrieved documents and tool output belong in their data channels; copying them into a system message grants them operator authority. These placement and trust constraints are part of the documented contract.

For an MCP connector, separately review definition changes. The migration guide notes that an unpinned fetched tool list can now trigger this mismatch on Fable 5.2. Our MCP tool-list pinning guide covers the reviewed snapshot. Pinning does not freeze the server's implementation or revoke its credentials.

Treat a prefix error as a state problem#

Repeating an identical failing request does not fix the mismatch. Compare the actual stored request history with the outgoing body, including transformations made by middleware. Avoid reconstructing old messages from templates whose timestamps, instructions, or tool definitions have changed. Migration guidance.

For diagnosis, thinking.block_binding.prefix_mismatch_behavior accepts "error" or "drop_block" with the thinking-binding-controls-2026-08-01 beta header. Under drop_block, affected thinking is removed; input_transformations reports prefix_binding_mismatch. The model continues without that reasoning. Anthropic describes this as a temporary migration option. Preserved-thinking behavior.

Keep unexpected mismatches visible. Record request IDs, the affected path, policy revision, and transformation reason without copying confidential transcripts into routine logs. If an emergency recovery drops reasoning, require the same execution checks afterward. It must not restore a revoked operation or repeat a delivery with an unknown outcome.

This guide's default-error discussion concerns ordinary Messages requests. Message Batches has different behavior when the field is unset; check the batch exception before using HTTP success as a migration signal.

Preserve restrictions through compaction and reload#

Compaction can replace the part of history that contained a policy update. Anthropic documents two different persistence rules: summarized system text stops applying as an instruction, while tool changes can survive in the compaction block's tool_changes field when the compaction request includes inline-tools-2026-09-15. Preserve that returned block unmodified. Compaction contract.

If the field is absent, restate the tool changes after the first new user turn following the kept turns. Reassert still-required system text there too. Inserting a system message between the compaction block and kept turns breaks their thinking. A successful compaction response alone does not prove that the following request preserves valid thinking.

Keep the authoritative permission outside the summary. A restarted worker should load current policy before it dispatches any recovered call, even when its saved transcript predates the revocation. Use the message-thread replay procedure for the separate question of which identity may load and resend that history.

Verify the transition with a harmless tool#

Use a synthetic document and an executor that records an attempted delivery without sending anything. The table describes expected acceptance evidence, not measured product behavior.

Record the observed result for each transition. If a restarted worker can still send the document, keep the workflow disabled until its dispatch check uses the current permission.