AI agents in your own cloud: what changes for regulated firms

In 60 seconds: Self-hosted Claude Managed Agents is a private beta requested through your Anthropic account team. You can operate the service and store history on your infrastructure; the conversation still travels to the model provider. For a professional firm, the first decision is which information you authorize for transmission. Without beta access, start with a bounded process inside your approved corporate AI tools and test with synthetic data.

Verified on November 13, 2026. The official November 12 announcement confirms the private beta. The Claude Platform release notes direct access requests to your account team. It is not generally available or freely activated in the console. The ClaudeDevs post on X is a reference to the announcement; this article’s technical conditions come from official documentation.

For a legal or accounting firm in Mexico, Peru, Colombia, Chile, Argentina, the Dominican Republic, or Paraguay, choosing where to store history warrants a technical review. Start with a fictional case file and map its path: original document, fragment a tool reads, model response, and draft a person reviews. That path shows what you need to control.

The three layers and who operates each

The model interprets the conversation and proposes actions. The service, also called the harness, coordinates calls, maintains sessions, and manages access to credentials. The sandbox is the isolated environment where commands execute and files are handled.

Managed Agents option	Model	Service and history	Sandbox
Hosted service with cloud sandbox	Anthropic	Anthropic	Anthropic
Hosted service with your own sandbox	Anthropic	Anthropic	You
Full self-hosted service	Selected inference provider	You	You

The self-hosted Managed Agents guide, verified on November 13, 2026, distinguishes these layers. The full deployment includes a server, PostgreSQL, and workers, in your cloud account or on-premise data center. The model runs at the inference provider.

With a self-hosted sandbox and hosted service, files and processes stay on your worker; history and tool results reach Anthropic’s service. Source verified on the same date. Buying or configuring your own sandbox does not move history into your database.

What leaves your network

Each model call includes the conversation so far, with prompts, tool inputs, and tool results. The Claude API is the default destination. Anthropic has no remote access to your server or its log. Source: data and access, verified on November 13, 2026.

Suppose a contract file stays in your sandbox. If a tool returns a clause containing names and amounts, that text enters the next model call. Keeping the original locally does not prevent that transmission. Design tools to return only necessary fields and inspect their responses using synthetic examples before connecting real case files.

Also review the destinations of connectors, repositories, and observability services you enable. A local record does not establish that the entire workflow stays local. Check outbound traffic and avoid writing entire documents into logs.

Credentials need their own design: the server can store new secrets in your secret manager; existing ones do not migrate automatically. See agent identity and credentials, verified on the same date. For signing authority and sensitive access, also read electronic signature credentials and AI agents.

If you have an Anthropic ZDR agreement, confirm its scope for Claude API calls and your chosen model. Model and feature exclusions apply. The hosted service stores transcripts and is not covered by that agreement; with self-hosting, you store them. Source: API and data retention, verified on November 13, 2026. ZDR does not turn an external call into processing inside your network.

Choosing inference and understanding the Azure fit

Documented configuration options include Claude API, Amazon Bedrock, Claude Models on Google Cloud managed by Google, Microsoft Foundry, or your own gateway. Foundry accepts an API key or Microsoft Entra identity. Source: inference provider, verified on November 13, 2026.

If your firm already contracts with Microsoft, Foundry may be an option for IT to evaluate identity and procurement. Having Microsoft 365 does not establish that Claude is included or approved. Ask IT to confirm the actual provider, model, processing terms, and region for your account. This article does not confirm a data region in Latin America.

For infrastructure, the Kubernetes guide, verified that day, now includes AKS: it requires Pod Sandboxing, and its chart only accepts publicInternet for that option. The guide asks you to test it on your cluster. Review that limitation if you need restricted network egress. The AKS reference does not certify your deployment or establish that a ready-made closed environment exists for your firm.

What you take on as the operator

Before choosing self-hosting, assign an owner and maintenance time for these tasks:

• Maintain PostgreSQL, test restores, and protect backups.
• Define deletion for sessions, files, backups, and audit exports.
• Control log access and review how much sensitive content gets recorded.
• Rotate secrets and revoke access when team members change.
• Separate clients or workloads that require different trust boundaries.
• Apply patches, review releases, and handle service and worker failures.

The data and access documentation specifies one tenant and trust level per deployment. Deleting a session does not remove backups, exported logs, or all persistent files. Verified on November 13, 2026. Define and test a complete deletion policy.

The quickstart, checked that day, warns that its Docker Compose stack is for development. Do not treat it as a production recipe. Also review the differences from the hosted service: for example, there are no equivalent webhooks or scheduled deployments. Include operational effort in your decision even before you have commercial pricing.

If you have 5–50 people and no account team

A small firm of that size probably does not have an Anthropic account team. If that is your situation, do not plan a delivery that depends on receiving beta access. You can work on the process now and evaluate these routes, subject to the relevant access and approval:

Route	Useful first task	What to check
Approved corporate AI	Prepare drafts with synthetic data inside authorized tools.	Which sources, accounts, and connections IT allows.
Hosted service	Evaluate an agent with bounded read access and human review.	Retention, provider, actions, and information authorized for transmission.
Your own sandbox	Evaluate tools close to internal systems.	Available access and capacity to operate the worker; history and results still reach the hosted service.
Open-weight model	Assess hosting the model itself if the requirement demands local inference.	License, hardware, quality for the task, and maintenance.

The sandbox route is documented in choosing an environment, verified on November 13, 2026. For the other decisions, read automation with approved corporate AI and open-weight models for a small business. Hosting a model requires a different assessment from hosting the agent service.

Ask the provider about beta eligibility in your country, access without an account team, pricing and commercial terms, available models, regions, and the availability timeline. The reviewed pages do not publish regional admission criteria, self-hosted rates, or a general availability date. There is a public server software license agreement, consulted on November 13, 2026; review the applicable terms before contracting.

Checklist before connecting a case file

• Inventory the process data, including what a tool can extract from each document.
• Specify which folders, clients, and fields the agent may read. Start with read access and test access denials.
• Record where each credential lives, who administers it, and how to revoke it.
• Name the person who reviews drafts and external actions. Retain approval for sending, signing, and sensitive changes.
• Define retention and deletion for each destination: service, model provider, files, backups, and logs.
• Test the path with synthetic data and document which information leaves the network.

Use the secure agent permissions guide to make access concrete. For legal work, a litigation second brain helps scope sources and review. Take the design to your adviser to review professional secrecy, personal data, and obligations in your country. Hosting alone does not establish compliance.