Claude Managed Agents for Business: Should Anthropic Host Your Agent?

Claude Managed Agents suits a business that wants a long-running agent without building the agent loop and sandbox itself. It does not suit work that needs zero data retention or a HIPAA business associate agreement today. It was also still in beta when we checked it.

Disclosure. eSEOspace sells Claude Code services, including Claude Code development. We are a member of the Claude Partner Network, as our service page states, and Claude and Claude Code are Anthropic's products. Weigh what follows with that in mind.

This guide is part of our AI agents for business hub. It was checked against Anthropic's documentation on 9 November 2026, and we did not test the product ourselves. It is general information, not legal advice.

What Managed Agents is

An agent needs a loop, a place to run code, and tools. Anthropic's Managed Agents overview describes the product as a pre-built, configurable agent harness that runs in managed infrastructure. Anthropic lists it as best for long-running tasks and asynchronous work.

The alternative is the Messages API, which Anthropic describes as direct model prompting access for custom agent loops and fine-grained control. With that route, your team builds and runs the surrounding system.

There are four parts to learn:

Sessions keep a filesystem and conversation history across interactions. Anthropic also lists recurring runs on a schedule. Built-in tools include shell commands, file operations, web search and fetch, and connections to MCP servers.

What it cost on 9 November 2026

Anthropic's pricing page says Managed Agents is billed on two dimensions: tokens and session runtime. Prices change, so confirm them before you budget.

The page says time spent idle, rescheduling or terminated does not count toward runtime. It also says the Batch API discount does not apply to sessions. Pinning inference to the US multiplies token prices by 1.1.

Anthropic's own worked example is a one-hour session on Opus 5.5 using 50,000 input tokens and 15,000 output tokens. Its total is $0.58, of which $0.08 is runtime. Runtime is a small part of that example, so plan around tokens first.

For how usage-based bills grow, see the hidden costs of AI agents.

The limits that decide the question

Beta status comes first. Anthropic's overview says: "Behaviors may be refined between releases to improve outputs." A process that cannot tolerate behavior changes needs its own tests before and after updates.

Data handling comes next. Anthropic's overview says: "Because of this, Managed Agents is not currently eligible for Zero Data Retention or HIPAA Business Associate Agreement (BAA) coverage." The stated reason is that sessions are stateful and store history server-side.

That limit also applies to self-hosted sandboxes. Anthropic's self-hosted sandbox page says tool execution moves to your infrastructure, while Anthropic keeps running the agent. It adds: "Tool inputs and outputs still flow to Managed Agents on Anthropic's side, so the model can receive results and determine what to do next."

If the agent would process protected health information, Anthropic's documentation offers no HIPAA BAA coverage for this route. Anthropic's data retention page describes HIPAA-ready access for eligible Claude API features, under a signed BAA. Have your privacy counsel confirm what applies to you.

You do keep some control. Anthropic says you can delete sessions and uploaded files through the API. The same retention page says: "Retained data is never used for model training without your express permission."

What Anthropic hosts, and what stays your job

Hosting moves the infrastructure work. It does not move the judgment about what the agent may do.

Anthropic's security page for Managed Agents is direct on this point. It says: "Claude is inherently resilient to it, but model behavior is not a security control." The "it" there is prompt injection, meaning hidden instructions in content the agent reads.

The same page lists settings that limit the damage: the smallest tool set, approvals for risky actions, credentials held in vaults, and restricted networking. It then says: "These settings lower the risk but do not remove it, so do not put data in the sandbox that must never leave it." Your custom tools, MCP servers and self-hosted infrastructure stay your responsibility.

Check one default before launch. Anthropic's permission policies page says the agent toolset defaults to always_allow, and MCP toolsets default to always_ask. So built-in tools such as shell and file operations can run with no confirmation unless you change that setting.

A plain way to decide

Managed Agents is a reasonable candidate when these are true:

• The task runs for minutes or hours and uses several tools.
• You do not want to build an agent loop or sandbox.
• The data does not require zero data retention or a BAA.
• You can accept a beta product and retest after changes.
• Someone on your side can set permissions and review what the agent did.

Look elsewhere when these are true:

• The job follows fixed steps. Anthropic's guide to building agents says: "When building applications with LLMs, we recommend finding the simplest solution possible, and only increasing complexity when needed."
• The agent would process protected health information, or you need zero data retention.
• You need the Batch API discount for large offline jobs.
• You want full control of the loop. The Claude Agent SDK guide covers that route.

Questions to answer before you commit

1. Which tools does this agent truly need, and which can be disabled?
2. Which actions must pause for a person?
3. Where do session transcripts go, and who deletes them on what schedule?
4. Which keys does it hold, and are those keys limited at the service that issued them?
5. How will you test it again when Anthropic changes behavior during the beta?
6. If you left, what would you need to rebuild?

Our AI agent security checklist expands on questions 1 to 4.

Next step

If a fixed process or internal tool would do the job, an agent may be more than you need. Our Claude Code development team builds websites, CRMs and internal tools that way. We can tell you which route fits, and we will say so if the answer is neither.

Frequently asked questions