Claude Managed Agents in Practice: Self-Correction + Long-Term Memory

At a live AI Engineer workshop, the Anthropic team demonstrated how to use Claude Managed Agents to build a research agent with self-correction and long-term memory capabilities. From basic conversation to multi-agent collaboration, and further to custom orchestration and scheduled tasks, this approach showcases a complete implementation path for managed agents in financial research scenarios.

Building from Scratch: Environment, Agent, and Session

The first step of the demo is to create a basic agent. The user enters a natural language instruction in the console, and Claude automatically generates the system prompt, name, description, and selects a model, then creates the agent and execution environment via API. The environment is essentially a sandbox template; developers can restrict accessible domains, pre-install Python packages, and prepare for subsequent calls to the SEC EDGAR interface.

Session communication is accomplished through event streams: the frontend sends user.message events, and the backend listens to the SSE stream and pushes the agent's responses back to the browser in real time. This mechanism supports all interactions from simple chat to long-running asynchronous tasks.

SSE (Server-Sent Events) is an HTTP-based server push technology that allows the server to continuously send a text-format event stream to the client over a single long connection. Unlike WebSocket's bidirectional communication, SSE is unidirectional (server → client), but it is simpler to implement, natively supports reconnection, and can directly reuse existing HTTP infrastructure. In agent scenarios, an agent executing a task may take seconds to minutes and produce multiple intermediate events (tool calls, thinking process, final output). The frontend subscribes to these events via SSE, enabling real-time progress rendering without polling or blocking for the complete response. This is the technical foundation that enables the article's "backend listens to the SSE stream and pushes the agent's responses back to the browser in real time" to support long-running asynchronous tasks.

SEC EDGAR is the U.S. Securities and Exchange Commission's (SEC) official electronic data collection, analysis, and retrieval system. All companies listed in the U.S. must file disclosure documents through it, such as financial reports (10-K, 10-Q) and material events (8-K). EDGAR provides free public APIs and full-text search interfaces, making it one of the most authoritative and structured data sources in financial research. The article's pre-installation of Python packages and restriction of accessible domains is precisely to enable the agent to safely call EDGAR interfaces to pull original disclosure documents as input for subsequent financial extraction and analysis.

Multi-Agent Collaboration and Skill System

The basic agent only has prompts and default tools. The second step of the workshop is to "upgrade" it: add skills for calling SEC, define sub-agents, and introduce a custom tool dispatch analysis. The main agent can delegate tasks to specialized sub-agents such as financial analysis and risk extraction, and can also generate copies of itself to handle unknown tasks.

One detail: sub-agents do not inherit the complete conversation history of the main session; they only copy tool descriptions, schemas, and prompts. This design avoids context bloat while retaining the capabilities needed for the task.

Skills are living artifacts that can be updated. In the demo, the team added support for a new form type, and thereafter new sessions referencing that skill automatically receive the update. This mechanism allows agent capabilities to be continuously iterated without rebuilding the entire system.

rubric here refers to a set of structured acceptance criteria predefined by the user, typically containing several check items and their pass conditions, such as "revenue figures match the original text," "risk points cover at least three items," "output is in the specified JSON structure." It transforms the vague "how well was it done" into explicit rules that a verification sub-agent can check item by item, which is the prerequisite for the Outcomes mechanism to make automated judgments. The quality of the rubric directly determines the effectiveness of self-correction: standards that are too loose allow errors to slip through, while standards that are too strict trigger invalid retries. In practice, it is recommended to write rubrics as objectively verifiable assertions rather than subjective descriptions.

map-reduce pattern originates from distributed computing. The core idea is to first split a large task into independent subtasks processed in parallel (map), and then aggregate and merge the results of each subtask (reduce). In the article, the main agent assigns each analysis target to an independent session—this is the map phase; sessions do not share context and can proceed in parallel. After all are complete, the main agent aggregates them into a unified report—this is the reduce phase. The advantage of this pattern is good horizontal scalability and that a single point of failure does not affect the whole, but it also requires subtasks to be as independent as possible, and the aggregation layer needs to handle edge cases such as inconsistent result formats and partial failures.

Self-Correction: The Outcomes Mechanism

The core highlight of the workshop is Outcomes—a self-supervision mechanism. The user defines the task, evaluation criteria (rubric), and maximum number of iterations. After the agent executes the task, it launches a verification sub-agent to check the output against the criteria. If it does not meet the requirements, the agent retries until the requirements are satisfied.

In the NVIDIA earnings analysis demo, the main agent first checks whether the memory store contains historical analysis, then calls sub-agents to perform financial extraction and risk assessment respectively, and finally generates a structured scorecard and updates memory. Only after the verification sub-agent confirms that the figures are accurate and the deliverables are complete is the task marked as complete. This is equivalent to giving the agent the ability to "self-check before submission," significantly improving the reliability of long tasks.

Shared Memory and Dreaming Evolution

A memory store shared across sessions is another key element of this approach. Different sessions can write and read knowledge about financial instruments, avoiding duplicate research. Furthermore, the Dreaming feature analyzes transcripts and memories across multiple sessions and automatically integrates and updates the memory store, enabling subsequent agents to obtain more accurate information.

The team mentioned that Dreaming currently only acts on memory storage and may in the future extend to skills, prompts, and agent definitions. This means agent systems are expected to achieve continuous learning: each run accumulates experience for the next.

Production-Grade Security: Vaults and Credential Injection

In the demo, SEC credentials are placed directly in the prompt, but production environments require a more secure approach. Vaults allow developers to define secrets; only placeholders are injected into the session, and only when accessing pre-allowed domains does the platform replace them with real credentials at egress. If the agent attempts to use the secret for an unauthorized domain, the replacement does not occur.

Vaults also support OAuth credentials and MCP authentication, and can package authorization for services such as Notion. For MCP services that should not be exposed to the public internet, the platform provides an MCP tunnel feature; if enterprises need full control over network boundaries, they can also connect a self-hosted sandbox.

MCP (Model Context Protocol) is an open protocol proposed by Anthropic for connecting models to external tools and data sources in a standardized way. An MCP server exposes a set of tools and data resources, and clients (such as the agent runtime) discover and invoke them according to the protocol, thereby avoiding the need to write adapter code separately for each integration. The article mentions that Vaults can package MCP authentication for services such as Notion, and provides a tunnel for MCP services not exposed to the public internet, indicating that MCP has become the primary interface form for extending capabilities on this platform; the need to build MCP or custom tools yourself when replacing the memory provider also confirms this.

OAuth credentials refer to access tokens obtained based on the OAuth 2.0 authorization framework, which allow third-party applications to access a user's resources with the user's authorization without sharing account passwords. Compared with static API keys, OAuth tokens usually come with scope restrictions and expiration times, can be refreshed and revoked, and have lower leakage risk. Vaults supporting both OAuth and ordinary secrets means the platform can uniformly manage different authentication forms at egress and decide whether to inject based on a domain allowlist, thereby reducing credential exposure while maintaining convenience.

Custom Orchestration and Scheduled Tasks

When 10 or 100 targets need to be analyzed simultaneously, single-session serial processing is insufficiently efficient. The workshop demonstrates using the dispatch analysis tool to build a custom orchestration layer: the main agent assigns each target to an independent session, and aggregates the results after all are complete. This map-reduce pattern allows managed agents to scale horizontally.

Finally, the Deployments API supports running sessions on a schedule, suitable for long-term analysis that requires regular updates. Combined with the memory store, agents can continuously track target developments over a time span of weeks or even months.

Architectural Choices and Limitations

The live Q&A clarified several key questions. The managed agent harness is inspired by Claude Code but rebuilt for general scenarios, and is a different product from the Agent SDK: the latter is a downloadable binary, while the former is a fully managed service including hosting, sandbox management, scaling, and event log storage.

The current platform does not provide session rollback or forking; users can only guide the agent through new events and cannot return to a historical node to retry. Budget control is also not yet built in and needs to be implemented by developers in the orchestration layer. In addition, the platform does not bind memory storage; data can be exported via API, but replacing the memory provider requires building MCP or custom tools yourself.

Overall, this approach encapsulates the infrastructure complexity of agents, allowing developers to focus on orchestration logic and business value, while providing practical mechanisms for reliability and continuous learning through Outcomes and Dreaming.