With the ordinary Messages API, your application owns the agent loop: it calls Claude, catches tool-use requests, runs the tools, posts results back, and keeps going until the task is done. Claude Managed Agents (beta) is Anthropic's hosted runtime that takes over that orchestration. You define an agent (its instructions and tools), start a session, and the runtime drives the multi-turn loop — including long-running, multi-step work — while your systems interact through events and webhooks instead of babysitting each turn. Availability is narrow: Managed Agents exists only on the first-party Claude API and on Claude Platform on AWS, both in beta. It is not on Amazon Bedrock, Google Vertex AI, or Microsoft Foundry, which makes Claude Platform on AWS the only way to get it under AWS authentication and AWS Marketplace billing.
The building blocks
On Claude Platform on AWS the full Managed Agents surface is available: agents, environments, sessions, credential vaults, memory stores, webhooks, multiagent orchestration, and self-hosted sandboxes. In brief:
| Resource | What it is |
|---|---|
| Agent | The definition — instructions, tools, configuration |
| Session | One run of an agent: the event stream, conversation history, and state |
| Environment | Where agent work executes, including self-hosted sandbox workers you run yourself |
| Vault | Credential storage for tools; secret fields are write-only and never returned by reads |
| Memory store | Persistent memory across sessions, with version history |
| Webhook | Push notifications of session events; the signing secret is write-only |
Governance is AWS IAM, resource by resource
Every one of those resources maps to IAM actions in the aws-external-anthropic namespace — CreateAgent, GetSession, UpdateVault, and so on — scoped to workspace ARNs. A few edges deserve attention. Agents support only archiving, not hard deletion, and a Deny on Delete* does not block ArchiveAgent. GetSession returns the full event stream including conversation history, so "read access to sessions" means "read access to everything the agent said and saw." RotateWebhookSecret is not matched by Create*/Update*/Delete* wildcards and must be granted explicitly. The managed policy AnthropicLimitedAccess bundles the inference set plus all Managed Agents actions, and AnthropicSelfHostedEnvironmentAccess is purpose-built for sandbox worker processes. On the audit side, vault and webhook actions log as default-on CloudTrail management events (they hold secrets); most other Managed Agents actions are data events you must explicitly enable.
The one behavioral difference from first-party
Managed Agents on Claude Platform on AWS has a documented divergence: a session can run autonomously — with no user events — for at most 6 hours, after which it requires reauthentication via any user-role event. The first-party API has no autonomous-session runtime limit. If you design multi-day unattended agents, plan for that periodic touch on this platform.
Cost and data handling
Tokens are billed at standard model rates (prompt caching multipliers apply; web search at $10 per 1,000 searches). On top of tokens, session runtime bills at $0.08 per session-hour, metered to the millisecond and only while a session's status is running. Note what does not apply to Managed Agents sessions: the Batch discount, fast mode, data residency multipliers, and cloud platform pricing adjustments. On retention: session transcripts persist until you delete them, and Managed Agents is not covered by zero-data-retention arrangements — it is one of the features Anthropic classifies as fundamentally stateful. As everywhere on this platform, Anthropic is the data processor for inference content; confirm your compliance requirements accordingly.
Where to go next
The concepts are covered in Managed Agents sessions, environments, credential vaults, and webhooks. For deciding whether you need an agent at all, start with agent vs. workflow.