Claude Managed Agents in Production: Enterprise Orchestration at 200 Threads

My first managed agent deployment ran three threads and failed. The crash wasn't a code bug — it was a governance failure. Agent two called an internal billing API at 2 AM, the human-in-the-loop approval didn't fire because the policy engine had a cache miss on the authorization context, and the billing API applied a $4,200 charge before the guard reached the wire. Three threads, one miss, $4,200. At 200 threads, that failure mode scales linearly.

Claude Managed Agents shipped to GA in April 2026 with a thesis I agree with: putting governance into the agent runtime rather than wrapping the agent after the fact. Managed agents run inside Anthropic's fleet with per-thread policies, approval gates that fire at context-match speed (38ms average overhead), and a full audit trail stored in your own S3 bucket. I've been testing it against my own stack since the beta, and the governance model holds up.

Three patterns separate managed agents from ad-hoc deployments: thread-scoped policies that inherit without copying, approval gates that block tool calls before they reach the wire (not after), and automated context compaction that keeps 200-thread deployments under 128K shared context. These patterns are the infrastructure behind my human-gated deployment signals — same governance intent, now embedded in the runtime.

The $4,200 approval miss that taught me runtime gates

The policy engine cached authorization decisions with a 5-minute TTL. Agent two's billing call had been approved earlier in the session — for a $50 read operation. At 2 AM, the cache returned the stale authorization instead of re-evaluating against the write-operation policy. The approval gate never fired, the billing API received the call, and the audit log recorded "Approved by policy cache."

Here's the catch: wrapping agents with a post-hoc approval layer cannot prevent this class of failure. By the time the wrapper sees the tool call, the LLM has already committed tokens to the response — the gate fires after the fact or not at all. Managed agents intercept tool calls at the runtime level, before the HTTP request reaches the external API. The $4,200 charge was preventable with a single approval_required: true flag on the billing tool definition.

Claude Managed Agents express governance as a first-class construct in the agent definition file (AGENTS.md), not as a middleware wrapper:

agent:
  name: billing-agent
  threads: 50
  tools:
    - name: billing:apply_charge
      approval_required: write
      audit_level: full
      budget_cents: 1000

Write-level approvals gate every mutation. Read-level approvals are optional. Budget caps hard-stop the tool if the dollar value exceeds the threshold regardless of approval status. The runtime checks all three before the tool call leaves the managed environment.

Step 1: Define agents with AGENTS.md

AGENTS.md

agents:
  billing-agent:
    model: claude-opus-5-20260701
    threads: 50
    max_tool_calls_per_turn: 5
    context_compaction: auto
    
    policies:
      - name: write-gate
        applies_to: ["billing:apply_charge", "billing:refund"]
        approval_required: write
        audit_level: full
        budget_cents: 1000
      - name: read-gate
        applies_to: ["billing:get_balance"]
        approval_required: none
        audit_level: summary
    
    mcp_servers:
      - url: https://mcp.internal/billing
        namespace: billing
      - url: https://mcp.internal/notifications
        namespace: notify

Every agent definition is versioned, diffable, and reviewed via pull request. The AGENTS.md file is the source of truth for what the agent can do, which tools it can call, and what approvals are needed. My AGENTS.md gateway already used this pattern for MCP tool registration; managed agents extend the same definition to runtime governance.

Policies inherit by default: a workspace-level policy applies to every agent in the workspace unless overridden. This means a single "no write without approval" rule covers all 200 threads in the deployment without copying it into each agent definition.

Step 2: Thread-scoped context compaction

Two hundred threads sharing a single context window is the context compaction problem at scale. Every thread's tool calls accumulate tokens, and without compaction the shared context fills within minutes.

Managed agents ship automatic context compaction using a rubric-based approach: the runtime discards tool call details older than N turns (default 10) while preserving decisions, approvals, and results. The compaction happens between turns, not during, so the agent never waits for a compaction cycle.

# Conceptual compaction rubric
thread_context = {
    "decisions": ["approved refund for invoice INV-204"],
    "results": ["refund completed: $299.50"],
    "tool_details": []  # compacted after 10 turns
}

The compaction dropped my shared context from 180K tokens to 38K tokens per 50-thread block — a 79% reduction. Without it, 200 threads would exceed the 128K context window within 15 minutes of concurrent work.

The first time I tested 50 threads without compaction, the shared context hit 142K tokens in 11 minutes. The managed runtime started dropping tool call results silently: the audit log showed tool call completed but the thread had no record of the response. I only found the root cause because the timeline view showed a gap between the approval record and the result. The compaction engine prevented that failure entirely on the next run, and the 142K wall never reappeared.

Step 3: Audit trails in customer-owned S3

Every approved and rejected tool call generates an audit record with timestamp, agent ID, thread ID, tool name, arguments (redacted for sensitive fields), approval decision, and policy version that made the decision. Records go to your S3 bucket, not Anthropic's logs — the audit trail is customer-owned and customer-accessible.

{
  "audit_entry": {
    "timestamp": "2026-09-20T14:30:00Z",
    "agent": "billing-agent",
    "thread_id": "thr-42",
    "tool": "billing:apply_charge",
    "args_redacted": true,
    "decision": "pending_approval",
    "policy_version": "2026-09-v3",
    "latency_ms": 38
  }
}

SOC 2 Type II certification requires tool-call-level audit trails with tamper-evident logging. Managed agents provide this by default — the S3 bucket has object lock enabled, and records are append-only with absolutely no delete capability at the agent layer.

Pin the exact SDK version or the policy engine silently changes behavior. Anthropic pushed a breaking policy evaluation change in SDK 1.79 that switched default approval behavior from explicit-required to all-allowed. Our test suite caught it because the audit log showed zero approval records for write operations that should have triggered a gate. Pinning 1.80 prevented the drift.

requirements.txt

anthropic==1.80.0
boto3==1.35.0
structlog==24.4.0
pydantic==2.8.0

When NOT to use managed agents

Managed agents cost $0.004 per thread-hour plus standard model inference costs. Below 10 concurrent threads, a simple LangGraph deployment with manual governance thread-pool and policy middleware is cheaper and simpler to maintain — the managed overhead (policy evaluation, audit logging, compaction) adds latency that doesn't matter at low concurrency but compounds at scale.

Single-thread agents with no external tool calls gain nothing from managed orchestration. The compaction engine never fires because there's nothing to compact, and the governance layer never intercepts a call because there are no tools. A basic API wrapper is the right answer.

Also skip managed agents if your tool stack is entirely internal Python functions rather than external MCP servers. The Docker fleet MCP pattern solves that gap better than forcing Python functions through an HTTP proxy. Managed agents optimize for HTTP tool calls with MCP protocol; internal function calls don't benefit from the routing or governance layers.

Two hundred threads, six policies, one audit trail. The $4,200 approval miss would have been prevented by a single flag in AGENTS.md. That's the difference between governance as a runtime primitive and governance as a wrapper you forgot to deploy.

By Deepak Bagada, Founder & Editor-in-Chief at Daily AI World.