Operate: running Managed Agents in production

Why it matters

When an agent acts for many users, each tool call spends someone’s credential. 3.2 asks you to keep that choice outside the prompt; this notebook shows one platform doing so.

What to practise

Create a vault for one end user with your internal user ID in its metadata, and attach a static_bearer credential for the GitHub MCP server. Give the agent an mcp_toolset whose default_config is enabled with an always_allow permission policy, and pass vault_ids on sessions.create: the agent calls GitHub without seeing the token, and without asking first. Read the webhook handler: it verifies a signature, reacts to session.status_idled, and posts a user.custom_tool_result after human review. Pin inference_geo, update an agent version, and archive credentials before their vault.

How it fits

The vault practises 3.2.1’s per-user principal and 3.2.3’s credential custody; its metadata feeds 3.2.5’s access trail. For 3.7, compare its rule of thumb with 3.7.1 and 3.7.2: an MCP toolset for a public service, a custom tool for one reachable only inside your network.