---
type: "post"
id: "operate-claude-managed-agents-inside-your-security-perimeter-119ad1"
slug: "operate-claude-managed-agents-inside-your-security-perimeter-119ad1"
title: "Operate Claude Managed Agents inside your security perimeter"
description: "Anthropic has opened a private beta of self-hosted Claude Managed Agents, letting teams run the agent harness, sandboxes, credentials, and session history in their own cloud or on-premises environment."
retrieval_nugget: "Anthropic has opened a private beta of self-hosted Claude Managed Agents, letting teams run the agent harness, sandboxes, credentials, and session history in their own cloud or on-premises environment. The change gives organizations more control over where agent infrastructure and records live, while retaining the core APIs used by the hosted service."
published_at: "2026-11-12"
updated_at: "2026-11-12"
record_date: "2026-11-12"
date_kind: "published_at"
topics: ["anthropic","claude","agent-harness"]
entities: ["Anthropic","Claude Managed Agents","Claude Platform","Amazon Bedrock","Google Agent Platform","Microsoft Foundry","OpenTelemetry"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Anthropic has opened a private beta of fully self-hosted Claude Managed Agents, letting companies run agents, credentials, and session history in their own cloud or on-premises environment."
prior_refs: []
source_url: "https://claude.com/resources/articles/self-hosted-claude-managed-agents"
source_urls: ["https://claude.com/resources/articles/self-hosted-claude-managed-agents"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:operate-claude-managed-agents-inside-your-security-perimeter-119ad1"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/operate-claude-managed-agents-inside-your-security-perimeter-119ad1/","markdown":"https://newruntime.com/posts/operate-claude-managed-agents-inside-your-security-perimeter-119ad1.md","json":"https://newruntime.com/posts/operate-claude-managed-agents-inside-your-security-perimeter-119ad1.json"}
markdown_url: "https://newruntime.com/posts/operate-claude-managed-agents-inside-your-security-perimeter-119ad1.md"
---

# Operate Claude Managed Agents inside your security perimeter

## Retrieval answer

Anthropic has opened a private beta of self-hosted Claude Managed Agents, letting teams run the agent harness, sandboxes, credentials, and session history in their own cloud or on-premises environment. The change gives organizations more control over where agent infrastructure and records live, while retaining the core APIs used by the hosted service.

## Summary
Anthropic has opened a private beta of self-hosted Claude Managed Agents, letting teams run the agent harness, sandboxes, credentials, and session history in their own cloud or on-premises environment. The change gives organizations more control over where agent infrastructure and records live, while retaining the core APIs used by the hosted service.

## What happened
Anthropic announced on November 12, 2026, that self-hosted Claude Managed Agents is available in private beta. Managed Agents is a suite of composable APIs for building and deploying autonomous agents; it supplies an agent harness, sandboxes, credential handling, and session history for long-running work. The new deployment option is aimed at developers building agents that operate directly on company code and internal systems. Teams can request access through their Anthropic account team.

Anthropic previously ran the Managed Agents infrastructure as a hosted service on Claude Platform. It also offered self-hosted sandboxes for teams that needed their code to remain in their own environment. The new option extends self-hosting to the whole service. Customers operate the Managed Agents server, its database, and the workers where agents run shell and file tools. Anthropic says the full service can run in a customer’s own cloud or on-premises, including the harness, sandboxes, credentials, and session history.

The model-request path is configurable. Requests can go directly to Anthropic, through a cloud provider—Amazon Bedrock, Google’s Agent Platform, or Microsoft Foundry—or through a customer’s own gateway. Developers continue to use the same core APIs as the hosted Managed Agents service. Session history is held in the customer’s database. Anthropic says an organization’s existing zero data retention arrangement with Anthropic applies to requests sent to Claude in the same way as it does to other Messages API calls. The announcement does not state a price or a general-availability date.

The post describes four architectural security principles. First, the harness that calls Claude is separated from the sandbox where agent code runs; the agent loop, session history, and vault secrets remain outside the sandbox. Sandboxes start when a tool needs one, and the agent does not depend on one sandbox lasting for its whole run. Second, credentials are kept outside the sandbox: a proxy adds credentials to MCP tool and supported API requests, and self-hosting teams can use their own secrets manager. Third, teams can restrict each environment to allowed hosts, with other requests blocked; self-hosted sandbox operators can enforce equivalent limits in their firewall. Fourth, each session records agent steps, tool calls, and results, with records exportable over OpenTelemetry for review in existing monitoring tools.

## What the archive adds
New Runtime’s earlier coverage on June 21 described Managed Agents as infrastructure for long-running agents, with Anthropic managing the agent loop, tools, and execution environment. This announcement is a new deployment option for that known product: self-hosting now covers the control plane and session history as well as the sandbox. No earlier New Runtime Field Note on this specific change is listed.

## Trend signal
This announcement supports [agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/): Anthropic describes controls implemented in the architecture and execution environment, including credential isolation, network allowlists, and inspectable session records. It is a vendor’s product description, not independent evidence that those controls prevent incidents or satisfy a particular organization’s compliance requirements. The signal is therefore about where controls are being placed, not proof of their effectiveness.

## Why now
Anthropic says agents are taking on more critical unattended work, including fixing broken builds, testing releases, triaging alerts, and working through bug backlogs. It says some teams want the entire service inside their environment because these agents need access to internal systems; previously, such teams had to build the platform themselves. The announcement frames full self-hosting as a response to that operational need.

## Why it matters
For teams considering agents that can touch source code, build systems, or internal services, the deployment boundary affects more than where compute runs. It determines who operates the orchestration service, where credentials and session history are stored, and how outbound access is constrained. A self-hosted control plane can make it easier to align agent execution with existing infrastructure and data-handling practices, while preserving the same core APIs as the hosted service.

That does not remove the operational burden. A team running the server, database, and workers becomes responsible for their availability, updates, monitoring, and configuration. The security principles Anthropic describes are design choices to evaluate, not a substitute for testing how the system behaves in the team’s own environment. Before adopting the beta, a builder should map each agent’s required tools and hosts, decide where model requests may go, and confirm that session records are usable in the organization’s review process.

The choice is not simply “hosted” versus “private.” Model requests may still be routed to Anthropic, a cloud provider, or a gateway, according to the customer’s configuration. Teams need to assess each path against their own data and governance requirements. The announcement offers no pricing or general-availability commitment, so organizations cannot yet infer the total cost or production support terms from this launch alone.

## Limits and uncertainty
Anthropic’s announcement describes the product’s intended architecture and private-beta access, but it does not provide independent security testing, operational benchmarks, or evidence of deployment outcomes. It does not specify pricing, infrastructure requirements, supported deployment configurations beyond cloud and on-premises, or a general-availability timeline. The announcement also does not quantify performance or reliability differences between hosted and self-hosted deployments. Teams will need to validate the implementation, provider routing, and applicable data-retention arrangements for their own setup.

## Reader takeaway
Self-hosted Claude Managed Agents moves the deployment boundary beyond the sandbox: customers can operate the harness, database, credentials, and workers themselves. That offers more control over agent infrastructure, but also makes the customer responsible for running it. Treat the private beta as an architecture and governance decision to test, not as independent assurance that an agent deployment is secure.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Agent Harness](https://newruntime.com/topics/agent-harness.md): Explore the agent-harness topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)