"Scaling Managed Agents: Decoupling the Brain from the Hands" is an engineering post published on the Anthropic Engineering Blog on April 22, 2026, by Lance Martin, Gabe Cemaj, and Michael Cohen. It documents the architectural evolution behind Anthropic's Managed Agents hosted service, describing how the design moved from a single-container layout to one that separates the agent's reasoning component, its tools, and its session log into independent interfaces. The authors present this brain/hands/session decoupling as a general design pattern and frame the underlying approach in terms of operating-system design.
Framing: infrastructure for "programs as yet unthought of"
The post states the Managed Agents design challenge as an old one in computing: how to design infrastructure for agents that do not yet exist. The authors' answer follows the operating-system model — virtualize the components into abstractions (process, file) general enough to outlast any specific implementation. They describe the initial single-container design, in which the harness, session, and sandbox all ran in one container, using the metaphor of "adopting a pet," contrasted later with treating components as "cattle."
Problems with the coupled architecture
The post attributes three categories of problem to the single-container layout:
- Reliability: Container failure meant a lost session, with no way to debug without opening a container that held user data.
- Security: Untrusted agent-generated code ran in the same container as credentials, so a prompt injection needed only to trick Claude into reading its own environment to steal auth tokens.
- Scalability: Every session paid full container setup cost upfront, even when no sandbox was needed, and the harness assumed all resources sat next to it, which blocked customer VPC integrations.
The decoupled architecture
The proposed solution separates three components into independent interfaces: the brain (Claude plus harness), the hands (sandbox and tools), and the session (event log).
The brain (harness) leaves the container entirely and calls sandboxes as tool calls of the form execute(name, input) → string. If the harness crashes, a new one boots with wake(sessionId), retrieves state via getSession(id), and resumes; the post characterizes the harness as cattle rather than a pet.
The hands (sandboxes) likewise become replaceable: if a container dies, the harness catches the failure as a tool-call error, and a new container is reinitialized with provision({resources}). Many hands can connect to one brain, and hands can be passed between brains.
The session (event log) is a durable log stored outside both the harness and the sandbox. The call emitEvent(id, event) writes during the agent loop, and getEvents() retrieves positional slices. The post stresses that the session is not Claude's context window but a recoverable external object.
Security architecture
The post describes the decoupled design as creating a structural security boundary, in which the sandbox where Claude's generated code runs never holds credentials. For Git, an access token is used to clone during sandbox initialization and is wired into the local git remote, so the agent pushes and pulls without ever seeing the token. For custom tools, OAuth tokens are stored in a secure vault; Claude calls tools through the Model Context Protocol via a dedicated proxy that fetches credentials from the vault, leaving the harness never credential-aware. The authors present this structural separation as preferable to narrow token scoping, on the argument that it removes the reachability problem rather than limiting what can be done with reachable tokens.
Performance
The post reports that decoupling enabled on-demand sandbox provisioning, invoked only when needed, so that sessions not requiring a sandbox no longer wait for container provisioning, and scaling to many brains amounts to starting many stateless harnesses. It cites first-party production metrics: p50 time-to-first-token (TTFT) dropped about 60%, and p95 TTFT dropped over 90%.
Context engineering
The authors describe the session-as-external-context-object pattern as a way to address irreversible decisions in long-horizon tasks. They argue that classic approaches such as compaction and trimming are irreversible because it is hard to know which tokens future turns will need. In their design, the session log stores all events durably, and getEvents() lets the harness fetch positional slices. Transformations such as compaction and cache optimization happen in the harness rather than the session, which the post frames as separating concerns and as enabling high prompt-cache hit rates through context organization without destroying recoverability.
Design philosophy
The post characterizes the Managed Agents system as a "meta-harness" — opinionated about interfaces (session, sandbox) but unopinionated about specific harness implementations. It notes that Claude Code is one harness, that task-specific harnesses excel in narrow domains, and that the system accommodates both. The authors acknowledge that harness assumptions "go stale as models improve," citing the disappearance of the "context anxiety" behavior of Claude Sonnet 4.5 in Claude Opus 4.5, which they say turned previously added reset logic into dead weight.
Key claims
The post advances the following claims, which it supports with first-party material:
- A decoupled brain/hands/session architecture resolves the reliability, security, and scalability problems created by monolithic containers (presented with first-party production metrics).
- p50 TTFT dropped about 60% and p95 TTFT dropped over 90% after decoupling (first-party measurement).
- Structural credential isolation, in which credentials are never reachable from the sandbox, is preferable to narrow scoping (a design judgment the post does not test empirically at scale).
- Harness assumptions go stale as models improve, while abstracted interfaces outlast implementations (illustrated by the context-anxiety example).
Provenance and relations to other pages
The post is one of the first public accounts of production-scale agentic infrastructure design decisions and introduces the brain/hands/session decoupling pattern as a general principle. It connects to several existing pages:
- Agentic AI — documents the infrastructure layer behind frontier agentic products; the harness/brain/hands vocabulary extends Mollick's models/apps/harnesses framework.
- Prompt Injection — presents credential isolation via structural separation as an infrastructure-level prompt-injection defense.
- Agent Architecture Patterns — describes the production infrastructure realizing the patterns from Building Effective AI Agents.
- Model Context Protocol (MCP) — Model Context Protocol used as the tool protocol, with the OAuth vault pattern for tool security.
Relationships
- supports: Agentic AI — production infrastructure architecture
- supports: Prompt Injection — structural credential isolation as injection defense
- related: Agent Architecture Patterns — infrastructure for agent patterns
- related: Model Context Protocol (MCP) — MCP as tool protocol; OAuth vault pattern
- related: Building Effective AI Agents — companion post on agentic patterns