Claude Managed Agents now cap web domains and show per-thread cost in the Console

Unattended agents need two answers before finance signs off: where can this thing browse, and what did that thread cost.

Anthropic shipped both in August 2026. Domain allowlists and blocklists landed on web_search and web_fetch. The Console session viewer gained a minimap, grouped transcripts, and an Inspector panel with per-thread cost. Memory stores extended to self-hosted sandboxes. None of this replaces the session budget work from August 7, but it makes budgets usable.

If you already run scheduled deployments and vaults or effort levels and webhooks, treat this as the control plane catching up to the feature plane.

Domain controls on browse tools

Browse-capable Managed Agents inherit prompt injection from every page they fetch. Vaults solved credential exfiltration at the network boundary for API keys. Domain controls solve which hosts search and fetch may touch.

Per the Managed Agents tools documentation, web_search and web_fetch entries on the agent_toolset_20260401 configs array accept:

• allowed_domains: only these hosts
• blocked_domains: everything except these hosts

Never both on the same config. The API rejects mixed rules with a 400 error.

Example shape:

{
  "type": "web_fetch",
  "name": "web_fetch",
  "allowed_domains": ["docs.anthropic.com", "github.com"]
}

This is the same mental model as vault domain allowlists for CLI keys, but aimed at untrusted remote content instead of trusted API endpoints.

I map domains in a spreadsheet with vault rules and MCP connector auth so security reviews have one page:

Cost tracking in the Console

Before this redesign, multi-agent sessions were a wall of events. You exported logs or built custom telemetry to answer "which subagent burned the budget."

The August Console update adds:

• Timeline minimap for long sessions
• Transcript grouped by model request
• Inspector with session cost, raw events, per-tool stats, mounted resources, and per-thread activity

That pairs with API-level session.usage events when a session goes idle. The payload includes cumulative list_cost, active_seconds, token totals, and an echo of the configured budget.

For fleets, this is the starting point for efficiency ratios: value delivered per dollar of list cost, per thread, without building Datadog dashboards on day one.

Session budgets still matter

Domain controls do not cap spend. Session budgets do.

Quick refresher from the budgets documentation:

Multi-agent threads and advisor calls share one session budget. Parallel in-flight work widens overshoot margins. Deployment-level budgets copy to each future session the deployment starts.

The Console cost view tells you what cap to set. The budget API enforces it.

Memory on self-hosted sandboxes

The same August wave let memory stores run on self-hosted sandboxes, not only Anthropic-hosted runtimes. That matters for teams with data residency requirements who still want persistent agent memory without giving up their VPC boundary.

Wire memory lifecycle webhooks from the July platform drop so your provisioner reacts when stores are created or deleted, instead of polling.

Rollout checklist I run on client fleets

1. Domain spreadsheet for every web_fetch and web_search config before enabling browse tools in production.
2. Canary budget at a small cent cap on a scheduled deployment; confirm budget_reached and session.usage in logs.
3. Console review of one multi-agent session per week; note which thread dominates list cost.
4. Webhook on session.budget_reached if no human watches the stream (supervisor decides raise vs stop).
5. Cross-check with Claude Tag identity policy if Slack-facing agents share the same toolset.

What this does not solve

• Domain rules do not filter prompt content inside allowed pages. You still need output policies and human gates on writes.
• List cost in the Console is public list price, not your negotiated invoice.
• Per-thread Console figures round independently and exclude session runtime pricing nuances. Trust session-level usage.list_cost for budget enforcement.

Anthropic is clearly building Managed Agents as a governed runtime, not a chat wrapper. Domain controls shrink the browse blast radius. Cost Inspector makes caps legible. Session budgets make caps enforceable.

If you are standing up a Managed Agent fleet with cron deployments and browse tools, book a free call. I will help you sequence domain rules, vaults, and budgets so the first unattended run does not become a finance incident.