secure-deployment-monitoring changedmanaged-agents/secure-deployment-monitoring
Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+6added
Lines−6removed
From line
10
where the diff opens
First seen
13 Oct 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 10, old and new numbered
/
from line 10
1010 betaHeader: managed-agents-2026-04-01
1111---
1212
13Optionally review each session's events with an offline job. Watch webhooks for sessions that need attention, and delete sessions you no longer need. To limit what an agent can do before it runs, see [Secure your Managed Agents deployment](https://platform.claude.com/docs/en/managed-agents/secure-deployment).
13Optionally review each session’s events with an offline job. Watch webhooks for sessions that need attention, and delete sessions you no longer need. To limit what an agent can do before it runs, see [Secure your Managed Agents deployment](https://platform.claude.com/docs/en/managed-agents/secure-deployment).
1414
1515## Optionally have an offline reviewer read every transcript
1616
17An offline reviewer is a job you run, separate from the sessions it reviews, that reads each session's events after they are written. Long sessions have too many events for a person to read, so the job has Claude read them. The review flags behavior beyond what the agent was granted. For a review prompt, setup steps, and working code, see the [security review recipe](https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review) in the Claude Cookbook.
17An offline reviewer is a job you run, separate from the sessions it reviews, that reads each session’s events after they are written. Long sessions have too many events for a person to read, so the job has Claude read them. The review flags behavior beyond what the agent was granted. For a review prompt, setup steps, and working code, see the [security review recipe](https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review) in the Claude Cookbook.
1818
1919## Monitor sessions and review retention
2020
from line 26
2626| Sessions that reach a budget or terminate | The `session.budget_reached` and `session.status_terminated` webhooks |
2727| Scheduled runs that fail to start a session | The `deployment_run.failed` and `deployment.paused` webhooks |
2828| MCP OAuth credentials that cannot refresh | The `vault_credential.refresh_failed` webhook |
29| Tool calls the server denied or paused | `evaluated_permission` on `agent.tool_use` and `agent.mcp_tool_use` events. In a multiagent session, also list each thread's events |
29| Tool calls the server denied or paused | `evaluated_permission` on `agent.tool_use` and `agent.mcp_tool_use` events. In a multiagent session, also list each thread’s events |
3030| What an agent did in a session | The Claude Console session viewer |
31| Behavior beyond what the agent was granted | An optional offline review job you run that reads each session's events. See [Optionally have an offline reviewer read every transcript](https://platform.claude.com/docs/en/managed-agents/secure-deployment-monitoring#optionally-have-an-offline-reviewer-read-every-transcript) |
31| Behavior beyond what the agent was granted | An optional offline review job you run that reads each session’s events. See [Optionally have an offline reviewer read every transcript](https://platform.claude.com/docs/en/managed-agents/secure-deployment-monitoring#optionally-have-an-offline-reviewer-read-every-transcript) |
3232
33To see why a session went idle, list its events with `types` set to `session.status_idle`, `order` set to `desc`, and `limit` set to `1`. The event is named `session.status_idle`, and the webhook is named `session.status_idled`. If `stop_reason.type` is `requires_action`, the session is waiting on you, and `stop_reason.event_ids` lists the events it is waiting on. To answer them, see [Answer tool calls that pause the session](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#answer-tool-calls-that-pause-the-session). In a self-hosted sandbox, an `agent.tool_use` event can be waiting for your sandbox to return the tool's result. With workflow runs open, a tool call can wait for your answer while the session stays `running`. Answer each call when its event arrives. See [While a run is open](https://platform.claude.com/docs/en/managed-agents/workflow-runs#while-a-run-is-open).
33To see why a session went idle, list its events with `types` set to `session.status_idle`, `order` set to `desc`, and `limit` set to `1`. The event is named `session.status_idle`, and the webhook is named `session.status_idled`. If `stop_reason.type` is `requires_action`, the session is waiting on you, and `stop_reason.event_ids` lists the events it is waiting on. To answer them, see [Answer tool calls that pause the session](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#answer-tool-calls-that-pause-the-session). In a self-hosted sandbox, an `agent.tool_use` event can be waiting for your sandbox to return the tool’s result. With workflow runs open, a tool call can wait for your answer while the session stays `running`. Answer each call when its event arrives. See [While a run is open](https://platform.claude.com/docs/en/managed-agents/workflow-runs#while-a-run-is-open).
3434
3535A webhook delivery can be missed, so also list your sessions on a schedule and check the idle ones.
3636
from line 38
3838
3939This list shows what Managed Agents keeps, and for how long:
4040
41* **Session history:** Kept until you delete the session. Archiving a session keeps its history. To keep a session's events, copy them to your own logs with the events API before you delete it. A `running` session cannot be deleted. See [Deleting a session](https://platform.claude.com/docs/en/managed-agents/session-operations#deleting-a-session).
41* **Session history:** Kept until you delete the session. Archiving a session keeps its history. To keep a session’s events, copy them to your own logs with the events API before you delete it. A `running` session cannot be deleted. See [Deleting a session](https://platform.claude.com/docs/en/managed-agents/session-operations#deleting-a-session).
4242* **Sandbox state:** Kept for 30 days after the sandbox is created.
4343* **Files a session produces:** Deleted with the session. Download the files you want to keep first.
4444* **Files you uploaded, memory stores, and vaults:** Not deleted with the session. Delete them separately.
No line in this hunk matches that.