Method · MoneyTell the agent: 'Here is an outcome. I want you to analyze NVIDIA's most recent quarterly filings. You're going to use Edgar identities. This is where your Edgar identities are. You have memory. So check if you've already done analysis previously and make sure that you use that instead of refiling and researching things that you already know.' Request two deliverables: write a note in memory for that specific company, and write a scorecard in a well-defined structured output saved in a specific file location. Send a user-defined outcome with a specific rubric, max iterations, and a description of the task at hand any time a session is started for a specific ticker.
Method, not a verified protocol.
AI Engineer · Build a Research Agent with Claude Managed Agents (Part 2 of 4) — Anthropic
Recommendation · MoneyIn a real production application, use vaults for credential injection instead of injecting secrets in the prompt. With vaults, you define a secret to inject in an environment variable but put a placeholder instead of the real secret; when Claude does work and wants to use that environment variable, it injects the placeholder value, and at egress the host swaps it for the real value — only on the host domains that you specified as allowed for that secret.
AI Engineer · Build a Research Agent with Claude Managed Agents (Part 2 of 4) — Anthropic
RecommendationUse the outcome system to run really long sessions: define an exit criteria and Claude keeps iterating until it meets that criteria.
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
RecommendationIf the agent is waiting for a custom tool result (e.g., human-in-the-loop set with 400), have a sub-agent handle the custom tool so the main coordinator agent stays free for receiving messages.
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
RecommendationAnthropic said the outcome system demoed is the best way to run really long sessions because you define an exit criteria and Claude keeps going until it meets that criteria. For a really long task, define a rubric (e.g., 'rebuild blank') and Claude will mercilessly iterate until it matches the rubric. There is nothing special needed to get a CMA session running longer than six hours; it should just keep going.
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
RecommendationAnthropic described sharing a single agent across multiple customers: keep the agent definition in YAML and build tooling to synchronize it to both workspaces, or model all customers in a single organization. Alternatively, create a single agent across all customers and manage the mapping of which customer is using which session. Anthropic gives tooling to synchronize a single definition in your code to multiple places via CI, updating all definitions at once. An agent copy is essentially a template of system prompt, model name, and tools that you can copy across every workspace. Sessions have a metadata field where you can put customer IDs to know which session mapped to which customer.
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
RecommendationAnthropic recommended defining an agent per customer so data is segregated, using a workspace per customer for true isolation, or an org per customer. They advised maintaining a mapping of which customer maps to which agent. If you care about data segregation, put customers in individual workspaces since resources are allocated per workspace. Data segregation between customers is a legal requirement because customers don't want to share data with other customers.
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
RecommendationAnthropic recommended keeping the main coordinator agent always free for receiving messages by having a sub-agent handle your custom tools. Define a main coordinator agent that can talk to agents B and C, where agent B is the one processing your custom tools; define the custom tool in the sub-agent's (agent B's) definition. The sub-agent emits the custom tool use, and you populate the custom tool result back to that sub-agent's session thread — the thread you listen to in order to get the custom tool result. If you want the main agent to be always chatty (responsive to messages), the coordinator pattern works pretty well. This also addresses the case where messages arrive while the agent is blocked waiting for a custom tool result (e.g., human-in-the-loop).
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
RecommendationAnthropic recommended designing your workspaces according to your access control needs — grouping people who need access to resource X into one workspace. They noted there are no fine-grained built-in controls for partial resource sharing (e.g., sharing memory but not an MCP channel), but as a builder/integrator you can implement granular partial sharing yourself so your end users get access to only part of a stack.
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
RecommendationAnthropic endorsed building an integration with CMA (Claude Code / GitHub) so that on a pull request it kicks off many sessions with many sub-agents to evaluate what changed and find bugs. They noted Anthropic internally uses code-review agents to do a lot of the uplift, reducing time spent per PR, reducing bugs, and keeping quality high, and that you can iterate in a review loop — review, add comments, review until done. Keeping up with agent-generated PR volume is still an open question the industry is exploring.
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
RecommendationAnthropic described building a multiplayer chat agent like Claude Tag with CMA: map each thread to a session on a per-thread level, and when a user messages a shared agent session, inject the message as a user.message identifying the sender (e.g., 'this is coming from Gabe') so everybody can message the agent independently. Give the agent tools to reply back, such as the Slack post tool, so the agent can decide when it wants to reply — but don't just mirror whatever the agent is responding; make the replies explicit. A multiplayer agent can share memory across sessions so it learns from each session. To model something like Claude Tag, use one agent per Slack channel, with each agent having its own separate memory and access only to messages within that Slack channel.
AI Engineer · Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — Anthropic
Method · MoneyKevin's team asked a coding agent to write 1,000 tests across 10 domains to cast a wide net and see what failures were caught. The 1,000 figure was arbitrary, not a meaningful target. They anticipated the run would take a few hours and be token-heavy, planned credential management accordingly, and let the agent figure out triage questions like whether a failure was a service issue or an MCP layer issue.
Method, not a verified protocol.
AI Engineer · https://www.youtube.com/watch?v=k72eLcYpVys
Recommendation · MoneyKevin recommends fuzz-testing your agent sandbox — asking it to complete a thousand workflows and seeing what results you get — as a very strong way to surface failure modes that are innocuous to humans. He adds: test your agents locally, but also fuzz test them with a wide set of domain tests remotely if you're looking to host agents on sandboxes.
AI Engineer · https://www.youtube.com/watch?v=k72eLcYpVys
Method · MoneyAn ordered fix-and-verify loop: (1) when potential coding issues come up in review, run an agent skill to resolve them — copy and paste the agent prompt meant to fix the suggestions, for each issue presented; (2) choose between reviewing each issue individually (to plan fixes hands-on with your agent) or auto-fixing all issues, which triggers verification, makes commits, and posts a summary of changes back to the PR; (3) after fixing PR findings, rerun the verification command rather than stopping at the local run — prompt your agent to run verification regardless of whether it decides to on its own, because the code has changed and a fix can introduce new issues; (4) make sure you've run all commands for the branch and identified what was deferred before declaring done.
Method, not a verified protocol.
AI Engineer · How to Build Quality Gates into Agentic Coding Workflows — Nnenna Ndukwe, Qodo AI
Method · MoneyAn ordered planning sequence: (1) after agents are verified and good to go, switch into plan mode; (2) use the repo-local workshop planning skill to turn the hands-on task in the README into a high-level implementation plan and a build-session execution plan, using separate high-level and execution-focused planning templates; (3) the plan must include an implementation skill handoff naming the first implementation skill and the test-driven development prompt to be chained next; (4) include skill routing so all skills the agent should kick off during implementation are planned ahead; (5) ensure the agent knows every step of the code-change process and determine the test plan; (6) if the agent doesn't prompt you to choose which workflow to implement, make that clear in the prompt.
Method, not a verified protocol.
AI Engineer · How to Build Quality Gates into Agentic Coding Workflows — Nnenna Ndukwe, Qodo AI
Recommendation · MoneyJavier Garza recommends that whenever you use an MCP tool you really check the code before accepting it, because accepting can trigger malicious behavior. When checking MCP code manually is impractical because servers are long, his recommendation is to use a tool that checks for malware. He also recommends not trusting projects no matter how many GitHub stars they have, and running a security scan on them, noting Snyk has a free one you can use on open-source projects.
AI Engineer · AI Security Engineer Foundations + Certificate — Javier Garza, Snyk
Recommendation · MoneyJavier Garza recommends redefining threat modeling scope for AI to include LLM models, prompt templates and system prompts, context windows, memory stores, and endpoints/APIs the agent can access — not just databases, credentials, tokens, and infrastructure.
AI Engineer · AI Security Engineer Foundations + Certificate — Javier Garza, Snyk
Recommendation · MoneyJavier Garza recommends storing secrets securely and granting AI agents access only to the resources they need, when they need them, and minimizing the access an AI agent has to reduce attack surface. He also warns that agentic tool tokens need to be stored in a way that they cannot be leaked, and that giving a local AI agent like OpenClaw access to everything lets it do things it is not supposed to do when it goes wrong.
AI Engineer · AI Security Engineer Foundations + Certificate — Javier Garza, Snyk
Recommendation · MoneyWhenever you use an MCP tool, really check the code — it's very important. Since reading is hard because most MCP servers are very long, use a tool that checks for malware and other issues in the code itself (Snyk has one; there are many others from other companies).
AI Engineer · AI Security Engineer Foundations + Certificate — Javier Garza, Snyk
Method · MoneyUse AI itself to help threat model: ask an agent to create the threat model for the app you are designing, generate attack scenarios and abuse cases, simulate attacks such as prompt injections so you can address the attack vectors, and have it suggest mitigations and security controls. Automatic threat enumeration from a data flow diagram is part of this.
Method, not a verified protocol.
AI Engineer · AI Security Engineer Foundations + Certificate — Javier Garza, Snyk