Self-hosted Claude agents: whoever owns the logs owns the pager

This morning I wrote about Notion and Fireworks AI: 'zero data retention' was a clause, not a fact. The day before, Anthropic had already shipped its answer to exactly that worry. Not as a contract clause. As architecture.

Since November 12, Claude Managed Agents can be self-hosted, in private beta. Access only through Anthropic's account team. Price: not disclosed. Customers: none named.

What's new

Until now, companies could only host the sandbox, the place where an agent runs code. Anthropic ran everything else, including credentials and the activity record. Now, Anthropic says, every part of the service runs in your own cloud or on-prem:

• The Managed Agents server, its database (PostgreSQL, holding session history) and the workers where agents use shell and file tools.
• Credentials stay outside the sandbox. A proxy attaches them to requests for MCP tools and supported API calls, and they can live in your own secrets manager.
• Each environment can be locked to an allowlist of hosts, enforced in your own firewall. Every step, tool call and result is logged and exportable via OpenTelemetry.
• You choose where requests to Claude go: Anthropic directly, Amazon Bedrock, Google's Agent Platform, Microsoft Foundry, or your own gateway.

The agent log is the new owned asset

The interesting part isn't the hosting. It's who owns the history. An agent that preps campaigns, sorts leads or drafts proposals records every step and why it took it. That's process knowledge. Your process knowledge.

My rule of thumb for in-house versus outsourced: keep in-house whatever needs judgment, context and accountability. Customer data, approvals, steering every partner, AI included. Until now, your agents' memory sat with the vendor. Now it can sit where your accountability already sits. That's the real shift: AI as an operating system you run, not an assistant you rent.

Strategically, routing to Bedrock, Google and Microsoft is Anthropic saying: we don't need to be your landlord as long as you use our model. That's a concession to enterprise procurement. Not charity.

The catch

Sounds like full control. It isn't quite.

• Claude itself still runs outside your network. You self-host everything around the model, not the model.
• You run, patch and configure the server, the database and the firewall rules. Whoever owns the logs owns the pager.
• Per Anthropic, credential protection covers only MCP tools and supported API calls. Anything else an agent can reach needs its own review.

AI doesn't fix broken operations. If you can't run a Postgres server properly today, self-hosting mostly hands you a new construction site.

What I'd do now

• For every planned agent, write down: which systems it touches, which credentials it needs, who approves. Without that list, where it's hosted doesn't matter.
• Settle with IT who runs such a server for the long haul. No answer, no self-hosting.
• Ask your vendor, whichever it is: where does our agents' history live, and can we export it?

Bottom lineSelf-hosting isn't a security feature. It's a decision about who hears the alarm at night.