The Shared Responsibility Model Comes to the Harness found that Anthropic named what is owned at each layer without documenting the seam.
For Managed Agents specifically, that is no longer the case, and the documentation is unusually direct about the thing a risk committee will ask first.
Anthropic publishes that Managed Agents carries neither zero-retention nor healthcare-agreement eligibility, states the reason — sessions are stateful resources whose transcripts persist until deleted — and extends the statement to every sub-feature of the product, self-hosted sandboxes included [5]. That is a vendor documenting a constraint on its own product in the place an architect checks before assigning a workload. It is the seam, written down.
The rest of this dispatch reads what that statefulness buys, because the same property that produces the eligibility statement produces the strongest cost control and the strongest approval gate in this arc.
Five Bands, One Held Together
Compare this to the AgentCore frame and one band carries the whole difference. There, the orchestration loop is the loop. Here, the loop and the session record are one band, held together on the platform side. Anthropic runs the loop and keeps the record of what the loop did.
The top two bands sit with the customer, as they do on the other platform: the agent definition — model, system prompt, toolsets, permission policies — is authored by the customer, and authorization of callers into the customer’s own application is the customer’s concern. The tools band is shared, because the platform supplies the gate and the customer declares which toolsets exist and what they reach.
Where Does the Session Record Reside?
With Anthropic, and electing a self-hosted sandbox does not change that.
This is the distinction most worth internalizing before a compliance review. Anthropic offers a managed cloud sandbox and a self-hosted sandbox running on the customer’s own infrastructure [1]. Electing the latter relocates tool execution. Orchestration remains on Anthropic’s side, and tool inputs and outputs still reach Anthropic’s control plane, because the model has to see results in order to act on them [4]. The execution boundary and the record boundary move independently, and only the second one settles the processor arrangement.
Sessions persist event history, sandbox state, and outputs server-side, and remain retrievable until removed [1]. Deletion is available through the API, so retention is a schedule the customer can operate rather than a fixed window [1]. What is not available is a commitment that the record was never retained at all, which is exactly what the eligibility statement says, and why it says it [5].
One further property belongs here, because it is a read-path control that is easy to mistake for a write-path one. An agent can pin an inference geography, and Anthropic enforces coherence across a multiagent roster: the coordinator’s pin and every member’s pin must all be set to the same value or all be unset, with a mismatch rejected as a validation error at save time and at session-create override [6]. That is genuine residency control, enforced structurally rather than by convention. It governs where inference happens. It does not change who processes the session record.
What Is the Hard Limit Denominated In?
Currency. This is the only currency-denominated ceiling in the arc, and it is the strongest single assurance primitive across all three platforms.
A session can carry an optional cap in whole cents, priced continuously at public list rates and evaluated between model requests, so overshoot is bounded by at most one request per thread [3]. At the ceiling the session goes idle rather than terminating, preserving conversation history and sandbox state [3]. Events that settle work already in flight — a tool result, a tool confirmation decision, an interrupt — are accepted. An event that would start new work is refused [3]. That is a control that fails closed on new spend while remaining open to completing what it already started, which is the correct shape for a long-running agent.
In a multiagent session the cap is a single shared ceiling across all threads, threads pause independently as it is reached, and each thread’s cost is priced at the model that thread was actually served by [6]. A budget therefore survives the case a token ceiling cannot: work distributed across several models still resolves to one number in one unit.
Two conditions belong in any specification that relies on it. Removing a budget from a session cannot be undone [3]. And a model without a public list price cannot be priced continuously, so it cannot be budgeted [3]. Both are stated by Anthropic, and both are the kind of detail that determines whether a control holds in production or only in a diagram.
Where Is the Tool Gate Declared?
In a configuration object the customer authors, and it pauses execution.
Permission policies are declared per toolset with per-tool override. Agent toolsets default to allow; connected server toolsets default to ask [2]. An ask decision does not fail the call — the session goes idle awaiting a decision and waits as long as it takes, and a denial returns a reason to the model, which continues with that knowledge rather than retrying blindly [2]. In a multiagent session the request is cross-posted to the primary thread with the originating thread identified, so a subagent’s permission request surfaces where a supervising client is already listening [6].
Three properties make this reviewable rather than merely present. The policy is authored, so a reviewer can read it and a release process can diff it. The default for connected servers is the conservative one, so a new external toolset arrives gated rather than open. And the denial is informative, so a refusal becomes part of the agent’s context rather than a silent dead end.
Change control exists here too. Agents are versioned, and a coordinator’s configuration — including its roster of delegable agents — is snapshotted when the coordinator is created or updated. Referenced agents stay pinned to the versions resolved at that moment and do not pick up later updates; delegating to a newer version requires updating the coordinator [6]. That is a pinning construct, and it means the composition of a multiagent session is a fixed artifact rather than a live lookup.
What the Customer Owes
Scope is declared per agent, and Anthropic documents it as the mechanism. MCP servers are agent-scoped while vault credentials are session-scoped, and the guidance for limiting an agent’s reach is to declare only the servers that agent needs [6]. That is least privilege expressed as configuration rather than as practice — and it is the customer’s to author. A session’s vault credentials reach every thread, so a credential supplied for one agent’s server is present in a session where other agents run.
Delegation is one level deep and a roster holds at most twenty agents, with twenty-five concurrent threads supported [6] — constraints that shape an architecture rather than merely bound it. And where a session uses an advisor, whether the advice is readable on the event stream is the advisor model’s policy: some advisor models deliver a redaction placeholder to every client surface while the agent reads the full advice server-side [6]. An assurance program that treats the event stream as a complete record of what informed a decision should verify that assumption against the advisor model in use.
Evaluation is available and is worth naming, because it is authored by the customer too. Outcomes take a rubric describing what success looks like, and a separate grader evaluates the output in its own context window so the assessment is not colored by the agent’s own reasoning [7].
Managed Agents is stateful by design, and Anthropic published what follows from that: the product carries no zero-retention or healthcare-agreement eligibility, across every sub-feature, self-hosted sandboxes included. That is the constraint stated in the place it belongs.
The same statefulness is why this platform has the arc’s only currency-denominated ceiling and its only tool gate that pauses a session and returns a reason. A session that persists is a session that can be stopped, asked, resumed, and priced. The architect’s decision is not whether statefulness is acceptable in the abstract. It is which workloads belong on a surface whose record is processed by the platform, and that decision is made at design time against the published statement rather than after an audit asks for it.
Next in the arc: the OpenAI Architect dispatch reads Presence against the same three questions, where each answer is determined per deployment rather than in configuration.
