Every agent post so far has been about frameworks you run yourself. Claude Managed Agents is the other model entirely: Anthropic runs the loop and hosts the sandbox, and you bring the agent and its guardrails. Knowing which half you own is the whole decision.
What Claude Managed Agents actually is
Claude Managed Agents is Anthropic's hosted platform for running agents. The difference from a plain API call is the shape of the work: you do not just send a prompt and read text back. You register an agent: a persisted, versioned configuration of a model, a system prompt, a set of tools, MCP servers, and skills. Then you start sessions against it. Each session runs on Anthropic's orchestration layer and gets its own sandboxed container as a workspace.
The mental model is agent, then session, then environment, then container. The agent is the reusable definition; a session is one run of it; the environment is the template for the container; the container is where bash, file edits, and code actually execute. As of 2026 it is a beta product, but the shape is stable enough to build on.
Brain and hands, decoupled
The agent loop (perceive, reason, act, repeat) runs on Anthropic's side. The tools it calls run in the container. That separation is the whole point of the word managed: you do not stand up the loop, you do not run the sandbox, and you do not persist session state. You create the agent once, reference it by ID, and every session inherits its configuration.
Because the agent is versioned, you can iterate on the prompt or add a tool without breaking sessions already running on the old version, and pin a session to a known-good version when you need reproducibility. That is a real operational win over a hand-rolled loop, where "what changed" is a much harder question to answer.
Tools, integrations, and staying in the loop
There are three kinds of tools. A built-in toolset (bash, file read, write, and edit, plus search and web fetch), MCP servers for third-party systems like GitHub or Slack, and custom tools that your own application answers. MCP is how the agent reaches the systems a client already runs without you writing a bespoke integration for each one.
Autonomy stays a dial, not a switch. Per-tool permission policies let you auto-run the safe calls and gate the risky ones: the session pauses and waits for an explicit approval before it acts. That is human-in-the-loop wired into the platform rather than bolted on afterwards, the same discipline we apply to every agent we ship.
Where the security story beats DIY
The credential model is the strongest part. Secrets live in vaults and never enter the container; they are injected into outbound requests at the edge, after the request has already left the sandbox. So code running in the sandbox, including anything the agent writes and anything a prompt injection coerces it into writing, cannot read or exfiltrate a key. That closes the exact hole that burned the permissive local-first frameworks.
Around that sit the rest of the platform primitives: isolated per-session containers, scoped tool permissions, and an event stream that records every message, tool call, and result for audit. Memory stores give an agent state that survives across sessions; multi-agent orchestration lets a coordinator delegate to specialist sub-agents; scheduled deployments fire sessions on a cadence. It is a great deal of the wiring we would otherwise build by hand.
When we'd reach for it, and when we wouldn't
We reach for managed when a client wants a stateful agent with a real workspace and does not want to own the loop, the sandbox, and the session plumbing. The default models fit the range of work: Opus 4.8 for the hard reasoning, Sonnet 5 for cost-sensitive production, Haiku 4.5 for routing and extraction. Anthropic runs the compute; we concentrate on the agent's definition, its guardrails, and how we evaluate it.
We stay on the API's own tool-use loop when a client needs to host the compute themselves, run a custom tool runtime, or keep everything on infrastructure they control. Managed offers a self-hosted sandbox for the middle case, where the loop stays with Anthropic but the tools run on hardware you own. If you are weighing hosted-and-managed against the local-first, own-the-runtime approach, the companion pieces "What Is OpenClaw? The Local-First AI Agent, Explained" and "Hermes Agent, Explained for Operators" cover the other side of the decision.