Building Production Agent Infrastructure with Claude Managed Agents

anthropic_/_various · Tech · 2026 · source Agentic: yes · promotional bias: high · source-backed · extracted with prompt 0.5.5 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Production infrastructure for autonomous agent systems

Claude Managed Agents addresses the shift from simple prompt-plus-tool-use agents to long-running, outcome-oriented, production agents that need context management, memory, execution environments, credentials, security boundaries, observability, reliability, identity, and scalable sandbox infrastructure.

Constraints:

• As agents become more capable, the bottleneck shifts from model intelligence to infrastructure around the model.
• Production agents need access to secure credentials, private repositories, internal systems, identity, and authorization.
• Long-running agents require sessions that can be observed, interrupted, resumed, and eventually picked up weeks or months later.
• Enterprises need sandbox execution without moving private files, services, packages, network policy, audit logs, or compute control outside their security perimeter.
• Agent-scale traffic raises unresolved questions around identity propagation, egress filtering, authentication, permission inheritance, state, and resume-ability.

Architecture

Claude Managed Agents is presented as a composable platform built around four primitives: agent definitions, environments, sessions, and event streams. An agent definition bundles system prompt, model, skills, tools, permissions, and identity. An environment provides the sandboxed computer-like execution context with network allow lists and preinstalled packages. A session represents a unit of agent work with lifecycle and recovery state. The event stream exposes user, agent, session, and span events so applications can observe and interact with agents in real time. Advanced capabilities include multi-agent orchestration, outcome rubrics with iterative grading, persistent memory, dreaming over thousands of sessions, self-hosted sandboxes, and MCP tunnels for private tool access.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  agent-definition["Agent definition"] --> session-manager["Session manager"]
  agent-definition --> sandbox-environment["Sandbox environment"]
  sandbox-environment --> tool-execution["Tool execution"]
  tool-execution --> mcp-tunnels["MCP tunnels"]
  session-manager --> event-stream["Event stream"]
  user-events["User events"] --> event-stream
  agent-events["Agent events"] --> event-stream
  session-events["Session events"] --> event-stream
  span-events["Span events"] --> event-stream
  event-stream --> application-dashboard["Application dashboard"]
  event-stream --> optimization-loop["Optimization loop"]
  session-manager --> outcome-loop["Outcome loop"]
  session-manager --> memory-store["Memory store"]
  memory-store --> dreaming["Dreaming"]
  session-manager --> multi-agent-orchestrator["Multi-agent orchestrator"]
  sandbox-environment --> self-hosted-sandbox-fleet["Self-hosted sandbox fleet"]
  self-hosted-sandbox-fleet --> sandbox-partners["Sandbox partners"]

Components

Data flow

A developer defines an agent, configures its environment, and starts a session. The agent receives user or outcome inputs, runs in a sandbox, invokes tools or MCP servers, emits event-stream records, and moves through session states such as idle, running, completed, and error recovery. Applications consume the API/event stream to display tool runs and agent actions. For enterprise deployments, Claude Managed Agents can signal a customer-controlled sandbox fleet to provision execution inside the customer's perimeter, while MCP tunnels connect private MCP servers without direct public exposure.

Why this architecture

Anthropic frames the platform as necessary because improved model intelligence moves the production bottleneck to infrastructure. Long-running agents need secure access to more systems, durable sessions, sandboxed compute, observability, event streams, memory, and outcome-based control. The composable primitive model lets developers pick the pieces they need rather than build all infrastructure themselves, while self-hosted sandboxes and MCP tunnels address enterprise security boundaries.

Models used: Claude 3 · Opus 4 · Opus 4.7 · Claude Code · Claude Managed Agents

Scale

• The platform targets agents that may run for hours and eventually complete quarters of work in hours.
  “when these agents work for like a couple of hours”transcript, stated

  “entire quarters' worth of work being able to be getting accomplished within a couple of hours”transcript, stated
• Sessions may need to be resumed weeks or months later.
  “picking it up later on, maybe weeks or months in the future when you want the agent to pick back up right where it left off”transcript, stated
• The demo surfaced a Python script running for over 20 seconds as an optimization opportunity.
  “a Python script ran for over 20 seconds”transcript, stated
• Dreaming reflects over thousands of sessions at once.
  “reflect and codify over like thousands of sessions all at once”transcript, stated
• Modal describes spinning up hundreds of thousands of sandboxes within minutes.
  “we can spin up uh, hundreds of thousands sandboxes in uh, in order of minutes”transcript, stated
• Modal runs in every major region and supports low-latency access.
  “we also run in every region uh, that you can imagine, so you can get low latency”transcript, stated
• Cloudflare isolates are described as spinning up in milliseconds.
  “it spins up in in, you know, milliseconds”transcript, stated
• Cloudflare expects far more agents as intelligence gets cheaper over the next two years.
  “2 years from now the Sanitas the world are running at Opus scale, we're just going to get a massive, massive amount of agents”transcript, stated
• Vercel explicitly discusses tasks paused with memory and resume-ability.
  “when I pause a task I can kind of like keep where I am in memory”transcript, stated

  “that like resume-ability of tasks is just like something that everyone is still like really um working to solve”transcript, stated

Alternatives considered (roads not taken)

Prompt-plus-tool-use agent patterns.

Rejected because: Anthropic says agents working for hours need task-completion and infrastructure pipelines rather than only prompt/tool loops.

Anthropic-hosted sandboxes for all tool execution.

Rejected because: Enterprises may need execution inside their own VPC, with private files, packages, services, audit logs, network policy, and provisioning under their control.

Expose private MCP servers directly over the public internet.

Rejected because: MCP tunnels provide a secure proxy/tunnel path for private MCPs without public exposure.

Single sandboxing primitive for all workloads.

Rejected because: Partners describe different needs for full VMs, isolates, GPU sandboxes, persistent volumes, custom images, and customer-owned fleets.

Synchronous, single-player agent work assumptions.

Rejected because: Vercel says agent traffic and resume-able tasks force teams to rethink synchronous collaboration and human-style work assumptions.

Patterns

tool-use-orchestration (agent_architecture)

Claude Managed Agents packages model, skills, tools, permissions, sandbox execution, custom tool results, and MCP configuration into managed agent sessions.

observability-tracing (operations)

The event stream emits user, agent, session, and span events so developers can observe agent work, timings, tool runs, and lifecycle changes.

durable-execution (execution)

Sessions, sandbox lifecycle, pause/resume/fork needs, and resume-able task state make long-running agent work durable rather than a one-shot request.

multi-agent-orchestration (agent_architecture)

Claude can spawn other agent threads with independent context windows and exchange messages for delegated specialized work.

agent-memory (memory)

Managed Agents includes long-lived memory stores plus dreaming to reflect across sessions and update memories.

eval-driven-development (evaluation)

Outcomes define rubrics or goals, trigger outcome grading, and let Claude iterate until satisfied.

human-in-the-loop-gate (control)

The event model includes confirmations for human-in-the-loop controls and interruptions when users need to steer an agent back on course.

safety-policy-enforcement (security)

The platform and partners emphasize sandbox isolation, network allow lists, audit logs, egress filtering, identity assignment, and private MCP tunnels.

Tradeoffs

Expose composable primitives instead of a monolithic agent application.

Chose Agents, environments, sessions, and event streams over Single bundled end-to-end agent app.

Rationale: Developers can choose the primitives they need and build product-specific agent applications on top.

Represent long-running work as sessions.

Chose Session lifecycle with status, recovery, outcome processing, and event streams over Synchronous request/response interactions only.

Rationale: Agents may work for hours, be interrupted, resume later, or complete goals asynchronously.

Use event streaming as the primary observability interface.

Chose Structured user, agent, session, and span event streams over Opaque agent execution with traditional logs only.

Rationale: Agent behavior is non-deterministic and long-running, so developers need real-time structured visibility into actions, status, errors, and timings.

Offer self-hosted sandboxes.

Chose Customer-controlled compute with Anthropic provisioning signals over Only Anthropic-hosted execution environments.

Rationale: Enterprises can keep execution within their own perimeter while still using Claude Managed Agents for orchestration.

Partner across different sandbox implementations.

Chose Cloudflare, Daytona, Modal, and Vercel integrations over One universal sandbox architecture.

Rationale: Different customers need full VMs, isolates, GPUs, custom images, persistent volumes, low latency, or customer-specific infrastructure primitives.

Use outcome-oriented control for autonomous work.

Chose Rubrics/goals with iterative outcome grading over Step-by-step conversational steering only.

Rationale: As agents get more autonomous, users can specify success criteria and let the agent iterate until the goal is met.

Gotchas (what bit them)

Infrastructure becomes the bottleneck as model capability improves.

Root cause: Agents move from short tasks to long-running, system-accessing work that needs reliability, scalability, security, latency control, credentials, and identity.

Resolution: Provide managed primitives for agent definition, environments, sessions, event streams, and sandbox execution.

Bad context management and memory can destroy agent effectiveness.

Root cause: Agents depend on retained context and cross-session memory, but incorrect implementation can degrade the model's ability to work.

Resolution: Treat context management and memory as managed primitives rather than incidental prompt code.

Agent observability is not optional in production.

Root cause: Without event-level visibility, teams cannot tell whether an agent is succeeding, why it acted, or where it is slow.

Resolution: Expose a categorized event stream and span timing so applications and operators can watch agent behavior in real time.

Enterprise agents need private execution and private tool access.

Root cause: Agents need private files, internal systems, repositories, and services that organizations cannot expose publicly or run on someone else's compute.

Resolution: Use self-hosted sandboxes and MCP tunnels so compute and private MCP access stay within controlled boundaries.

Agent identity and authorization do not map cleanly from human permissions.

Root cause: Agents may act on behalf of users, create other agents, and access multiple services, raising inheritance and chain-of-identity questions.

Resolution: Treat identity, permission propagation, service authentication, and egress filtering as platform-level design problems.

Agent traffic breaks human-user infrastructure assumptions.

Root cause: Agents generate compute and request patterns where the traffic source is autonomous software rather than a human.

Resolution: Rethink synchronization, resume-ability, multiplayer collaboration, storage, and sandbox lifecycle for agent-originated traffic.

Evaluation

The platform evaluates and observes agents through event streams, session state, span timing, outcome definitions and grading, and self-analysis of session transcripts. The Pascal demo shows Claude reading its own transcript to identify a script that took over 20 seconds and suggest runtime optimization.

Metrics: Session status transitions · Error recovery events · Outcome grading loop progress · Span durations for long responses and tool executions · Tool run/event stream visibility · Script runtime, including a demo script over 20 seconds · Memory quality through dreaming over thousands of sessions

Outcomes

• Anthropic introduced Claude Managed Agents with agent definitions, environments, sessions, and event streams as core production primitives.
• The Pascal demo showed managed sessions integrated into a custom dashboard, exposing tool runs, event streams, agent definitions, and environment configuration through APIs.
• Advanced features include multi-agent orchestration, outcomes, memory, and dreaming.
• New enterprise-oriented features include self-hosted sandboxes and MCP tunnels.
• Partners Cloudflare, Daytona, Modal, and Vercel provide diverse sandboxing strategies, including full VMs, isolates, GPU sandboxes, customer-controlled fleets, and shared infrastructure primitives.

The talk projects agents moving from simple tests to whole features, merge-ready PRs, quarters of work in hours, and sessions resumed weeks or months later. Operational scale signals include dreaming over thousands of sessions, Modal spinning up hundreds of thousands of sandboxes within minutes across regions, Cloudflare isolates starting in milliseconds, and demo feedback on a script running over 20 seconds.