Managed agents are AI agents whose execution is operated as a service. You define the agent — its model, instructions, tools, and routing — and the platform runs the loop: calling the model, dispatching tool calls, persisting state, streaming output, enforcing limits, and recording traces.
The contrast is with a self-operated agent, where you write the orchestration loop yourself (often with a framework such as LangGraph or CrewAI) and then own the hosting, retry semantics, streaming transport, state store, and observability that go around it.
What "managed" actually covers
The term is used loosely across the industry, so it is worth being specific about which layer is being managed. In Anter's case the managed surface is:
| Layer | What the platform operates |
|---|---|
| Execution loop | Step-by-step reasoning and tool dispatch, with a hard step ceiling per run |
| Routing | Transfer and delegation between sub-agents, validated against an allowed-targets list |
| State | Session history with a strict two-line-per-turn contract |
| Transport | SSE streaming with replay, so an interrupted run can be resumed |
| Safety | Permission resolution per tool call, failing closed when no approver is present |
| Observability | Per-run traces covering every routing decision and tool call |
Managed agents vs. a managed model API
A model API with tool-calling bolted on is not the same thing. In that arrangement you still write the loop that decides what to do with a tool call, when to stop, how to persist the conversation, and what happens when the connection drops mid-stream. The model is managed; the agent is not.
The distinction matters most in failure cases. A managed agent has defined behaviour when a run exceeds its step budget, when two routing intents conflict, or when a tool needs human approval and nobody is watching — see termination reasons and fail-closed.
Common misconception
Managed does not mean autonomous. An agent running on a managed platform still obeys whatever permission mode it was configured with, and a tool marked as requiring approval will be denied rather than silently allowed on an unattended run.