Skip to content
Beta Multi-model support (OpenAI, Gemini, and more) launching soon.
RBA RBA Skills

Execution & hosting

This page covers how a Runner actually runs: the substrate it executes on, the Sandbox that isolates it, and the decision of whether to self-host that substrate or adopt Anthropic’s hosted offering.

The substrate: Claude Agent SDK

Section titled “The substrate: Claude Agent SDK”

Runners are built on the Claude Agent SDK — not a fork of an existing agent. (Stripe forked goose in 2024 because the SDK didn’t exist yet; today the SDK is the substrate.) The SDK runs as a long-running process that executes commands in a persistent shell, manages files in a working directory, and carries tool context across a session.

Each Runner executes in a Sandbox — no production credentials, no network egress except through the Gateway. That isolation is what lets a Runner run without per-action permission prompts: the blast radius is bounded by the Sandbox and the Gateway’s scoped tokens, not by a human approving every step.

The decision: self-host the SDK, or adopt Managed Agents?

Section titled “The decision: self-host the SDK, or adopt Managed Agents?”

Since this plan was first written, Anthropic shipped Claude Managed Agents (public beta, 2026) — a hosted product that runs the agent loop, tool execution, and runtime on Anthropic-managed infrastructure, billed at token rates plus ~$0.08 per session-hour (metered only while a session is actively running). That makes the execution substrate a real build-vs-adopt choice.

What Managed Agents offers that’s genuinely useful

Section titled “What Managed Agents offers that’s genuinely useful”
  • Self-hosted sandbox mode (public beta): orchestration stays on Anthropic, but tool/code execution moves into a sandbox you control (Cloudflare / Daytona / Modal / Vercel). The agent’s code, filesystem, and network egress never leave your environment.
  • MCP tunnels (research preview): reach private, non-publicly-routable MCP servers over an outbound-only connection — no inbound firewall rules, no public endpoints.
  • Credential injection at the edge (e.g. the Vercel provider): the sandbox firewall injects credentials at the network boundary, so production credentials never enter the runner.

Combined, those satisfy two of the Fleet’s three hard constraints — no prod creds in the runner and egress only through a path you control — without building the Sandbox harness ourselves.

Why we don’t adopt it wholesale for governed Runners

Section titled “Why we don’t adopt it wholesale for governed Runners”

Two gaps are decisive for an agency that handles client data:

  1. No Zero Data Retention, no HIPAA BAA. Managed Agents is stateful by design (it persists conversation history, sandbox state, and outputs server-side) and is therefore not currently eligible for ZDR or a HIPAA BAA — and that applies even to the self-hosted-sandbox mode. This is the single biggest gate.
  2. No native customer-owned identity or unified audit. It does not natively provide customer-owned IdP (Entra/OIDC) short-lived token minting or a customer-side append-only per-tool-call audit log — which are exactly the Gateway’s job. Mature internal platforms (Uber) self-host execution on their own infrastructure with a customer-owned token service for precisely this reason.

The call: split by data-sensitivity tier

Section titled “The call: split by data-sensitivity tier”
  • The spine stays self-hosted, always. The Gateway, identity, and audit log are ours — that’s where the managed offering falls short and where the platform’s value lives.
  • The execution substrate is a per-Runner choice. For Runners that don’t touch ZDR/BAA-class data, Managed Agents’ self-hosted-sandbox + MCP-tunnel mode is a legitimate option that could collapse much of the rba-runner harness work. For sensitive Runners, self-host the Agent SDK.
  • Either way, the runner.json is identical. The managed-vs-self-hosted choice is one field (the sandboxProfile / execution target), so building the Registry never blocked on this decision.

A managed comparison worth weighing alongside Anthropic’s: Amazon Bedrock AgentCore offers managed per-session microVM isolation with VPC-only egress over PrivateLink — proof that a managed platform can meet a “no public egress” requirement, if the data-handling terms also fit.

Open questions

Section titled “Open questions”
  • Does Managed Agents’ self-hosted-sandbox + MCP-tunnel combination produce a complete, exportable, tamper-evident audit record of every tool call on our side, or only on Anthropic’s orchestration side?
  • Is ZDR and/or HIPAA BAA eligibility on the roadmap for GA? (“Not currently eligible” leaves room.)
  • TCO at Fleet scale: Managed Agents ($0.08/session-hour + tokens, idle not billed) vs. self-hosting the SDK on our own infrastructure vs. Bedrock AgentCore.

Sources

Section titled “Sources”