Claude Managed Agents

Claude Managed Agents (CMA) is anthropic’s cloud-hosted infrastructure platform for deploying autonomous, long-running agent workflows. CMA decouples agent reasoning orchestration from tool execution environments, providing sandboxed Linux microVMs, persistent server-side event logs, prompt caching, and granular permission gates. [source: anthropic-claude-managed-agents-overview-2026]

Core Architectural Primitives

graph TD
    A[Claude Managed Agents Platform] --> B[Agent: Model, Prompt, Tools, Skills]
    A --> C[Environment: Managed Cloud or Self-Hosted Sandbox]
    A --> D[Session: Stateful Execution Instance & Filesystem]
    A --> E[Events: Persistent Bidirectional Event Log]

1. Agent: Reusable definition specifying base model (Claude Opus/Sonnet), system prompts, MCP tool definitions, and skill packages.
2. Environment: Configuration for execution boundaries—either Anthropic-managed cloud sandboxes with pre-installed Linux utilities or self-hosted sandboxes for strict enterprise data residency.
3. Session: Stateful runtime instance binding an agent to an environment. Retains ephemeral filesystem state, tool outputs, and execution context across multi-hour turns.
4. Events: Authoritative, append-only server-side event store capturing every user input, reasoning phase, tool call, output, and error.

[source: anthropic-claude-managed-agents-overview-2026]

Decoupled Architecture: Brain vs. Hands

CMA implements the structural separation of machine reasoning from untrusted execution:

• The Brain: The reasoning engine running Claude models, managing prompt compaction, prompt caching, and context assembly.
• The Hands: Ephemeral, isolated execution sandboxes executing bash commands, reading/writing local files, querying web search APIs, or calling remote MCP endpoints.

[source: anthropic-claude-managed-agents-overview-2026]

Permission Gating & Human-in-the-Loop

CMA implements policy-based permission gates on sensitive tools (e.g., bash, custom actions):

• When a gated tool is selected, the session emits agent.tool_use and parks with session.status_idle containing stop_reason: requires_action.
• Clients resolve the gate by submitting a user.tool_confirmation event (allow or deny).
• Denials are fed directly into the transcript as tool error feedback, prompting the agent to adjust strategy without repeating identical failures. [source: assistant-ui-claude-managed-agents-2026]

Frontend & Protocol Integration

Via adapters such as AG UI and client libraries (copilotkit, assistant-ui), CMA sessions map 1:1 to user chat threads:

• Zero Local Message Tables: The frontend queries sessions.events.list() as the single source of truth.
• Stream Replay Consistency: Replaying past sessions and streaming active runs execute through the identical event-folding reducer. [source: assistant-ui-claude-managed-agents-2026]

Cross-links

• anthropic — platform creator
• ag ui protocol — frontend interaction protocol
• agent native infrastructure — underlying compute paradigm
• copilotkit — integration ecosystem partner