Managed agent runtime

What is a managed agent runtime?

A managed agent runtime is a hosted service that runs an AI agent for you. You describe the agent: which model, which instructions, which tools. The vendor runs everything around it: calling the model, executing tools inside an isolated sandbox, keeping session state, storing memory between runs, pausing for your approval before a risky action, firing recurring runs on a schedule and logging every step.

Compare that with building on a model API. There, your own code calls the model, reads the tool request that comes back, runs the tool, feeds the result back in and repeats until the job is done. Writing that loop is a day of work. Keeping it running for hours, resuming it after a crash, isolating the code it executes, keeping credentials out of the model's reach and tracing what it did afterwards is where the months go. That is the part the managed runtime sells.

Two flavours exist. Some runtimes supply the loop as well as the hosting: Anthropic's Claude Managed Agents, in public beta since April 2026, calls itself a pre-built, configurable agent harness that runs in managed infrastructure. Others host a loop you wrote: Microsoft's hosted agents in Foundry Agent Service take your agent as a container image, built with any framework, and run it in a per-session sandbox with identity, scaling and state handled by the platform. Google's Gemini Enterprise Agent Platform, formerly Vertex AI Agent Engine, sits in the second camp: its Agent Runtime hosts agents built with ADK, LangGraph and similar frameworks, with sessions and a memory bank alongside. The details differ, the division of labour is the same.

What the runtime takes off your plate

• The sandbox. Tool calls, shell commands and generated code run in an isolated container, not on your servers. Anthropic's cloud sandboxes are Linux containers with a stock of languages and utilities preinstalled and an outbound network you can restrict to an allowlist. Foundry gives each session its own VM-isolated sandbox with a persistent home directory.

• Session state. A session can run for hours, go idle while it waits for your reply, and resume with its filesystem and conversation history intact. Foundry deprovisions compute after an idle timeout of 5 to 60 minutes and restores the session's files when the next request arrives.

• Memory across runs. Anthropic mounts a memory store as a directory inside the sandbox, so the agent reads and writes it with ordinary file tools, and every change is versioned for audit and rollback.

• Permissions. A per-tool policy decides whether a call runs automatically or pauses the session until you send an allow or deny. In Claude Managed Agents, tools from an MCP server default to asking; the built-in file and shell tools default to allowing.

• Credentials. Anthropic's vaults keep API keys out of the sandbox: the agent sees a placeholder, and the real secret is swapped in at the network edge, only for the hosts you listed. Foundry gives each agent its own Entra ID identity to reach downstream Azure services.

• Scheduling. A scheduled deployment starts a fresh session on a cron expression, with a spend cap copied onto every run, and no scheduler for you to host.

• Tracing. Every model turn, tool call and result is recorded as an event you can stream or fetch later.

What stays your job

The runtime does not know your business. Four things remain yours whichever vendor you pick.

Instructions. The system prompt, the skills and the examples that tell the agent what good looks like. A hosted loop with vague instructions produces vague work faster.

Tools and data access. You decide which systems the agent can reach and through what: an MCP server, a custom tool your own code executes, a read-only database account. The runtime executes what you declared; it does not decide what should be declared. Least privilege is still your rule to apply.

Approvals. The permission policy is a switch. Which actions deserve a human gate, who answers the confirmation and how fast: that is a process decision on your side.

Evals. Whether the agent actually produces a correct report or a correct booking is something you have to test with your own cases, before launch and after every prompt or model change. No runtime measures that for you.

Where your data and your tools run

This is the question an SME with customer data should ask first, and the answer is not one place.

Vendor cloud sandbox. The default. Files, code and network egress live on the vendor's infrastructure for the life of the session. Anthropic is explicit that because sessions store conversation history, sandbox state and outputs server-side, Managed Agents on its cloud sandboxes is not currently eligible for zero data retention.

Self-hosted sandbox. Anthropic lets you run a worker process on your own Linux host. The model reasoning stays at Anthropic; the tool execution, the filesystem and the network reach move to your machine. Tool inputs and outputs still travel to the vendor so the model can read them, so it still matters what you let the agent read from those files.

Tunnels to private systems. To reach an internal MCP server without opening inbound ports, Anthropic offers MCP tunnels over an outbound-only connection, in a research preview with no uptime commitment. Foundry hosted agents can route outbound traffic through your own Azure virtual network to reach private databases and APIs.

How the bill is shaped

Three shapes show up, often combined.

Per session-hour plus tokens. Claude Managed Agents charges $0.08 per session-hour, metered only while the session's status is running, on top of the normal per-token model rates. Idle time waiting for your message is free.

Per unit of compute. Foundry bills hosted agents on the CPU and memory consumed across all active sessions. You pick a sandbox size per agent version, from 0.5 vCPU with 1 GiB up to 2 vCPU with 4 GiB, and Microsoft's own guidance warns that oversizing multiplies cost by your concurrency, because every session gets its own sandbox.

Per credit. Buy through a cloud marketplace and the same usage lands on your cloud bill as consumption units. Anthropic, for instance, converts session and token charges to Claude Consumption Units at a fixed price per unit when you buy through AWS Marketplace.

A worked example. A weekly reporting agent on Claude Sonnet 5 runs for 25 minutes, reads 150,000 input tokens and writes 20,000 output tokens. Tokens cost 150,000 times $2 per million plus 20,000 times $10 per million, so $0.30 plus $0.20. Runtime costs 25/60 of an hour times $0.08, about $0.03. Around $0.53 per run, under $30 a year. Set a session budget of a couple of dollars anyway: the platform pauses the session when the cap is reached, so a run that starts looping cannot surprise you.

Managed runtime or your own loop?

The honest comparison is on one axis: operational burden against control.

A managed runtime carries the operations. Sandboxing, resume after failure, credential handling, tracing and scheduling exist on day one, maintained by a vendor with more agent traffic than you will ever have. In return you accept their loop behaviour, their sandbox image, their permission model, their regions and their beta status.

Your own loop, built on an AI harness or framework, gives you every one of those decisions back. You can log to your own systems, run tools on your own network without a tunnel, swap models across vendors and shape approvals exactly as your process needs. You also own the pager when a session hangs at 3 a.m.

A low-code agent builder is the third option and sits on the far end of the same axis: least burden, least control. Foundry's prompt-based agents, defined entirely through prompts and tool configuration in a portal, are a good fit for a support assistant over a knowledge base and a poor fit for an agent that has to run code or work unattended for an hour.

The practical rule: build the prototype on the runtime, because it is the fastest way to find out whether the agent is worth having at all. Move the loop in-house only when a concrete requirement forces it, such as data that may not leave your network, an audit log format your sector prescribes, or a cost profile at volume that the per-session price no longer fits.

What to ask before you sign

Can I take my agent elsewhere? The agent definition is a prompt, a tool list and some skills, and you can keep it as a YAML file in version control. Tools served over MCP and custom tools your own code executes move with you. Session history, memory contents and the vendor's loop behaviour do not, so export memories through the API on a schedule if they hold anything you would miss.

Where does my data sit and for how long? Ask about retention per feature, not per vendor. Cloud sandbox and self-hosted sandbox answer differently on the same platform.

What caps a runaway session? A hard spend budget per session or per scheduled run should be a checkbox, not a feature request.

What is still in preview? Tunnels, memory and self-hosting arrived at different maturity levels. A dependency on a research-preview feature is a dependency on the vendor's roadmap.