Claude Managed Agents extends network limits to search and web fetch

Claude Managed Agents also extends network restrictions to web and web fetch search tools in cloud limited environments. The notes of the October 7, 2026 indicate that allowed_hosts applies to these instruments, making the perimeter of destinations more consistent within reach. The date and change are given in the release official notes.

For a company it means being able to design an agent that consults a defined set of sources, instead of treating the web as an indistinct space. The novelty does not eliminate all hostile instructions and does not prove that each configuration is protected. A permitted destination is an authorized access, not a guarantee of truth or harmlessness of the content.

What changes for web search and web fetch?

The Web tool restrictions guide distinguishes the domain allowlist and URL rules in the previous context. Control should not be described as a single generic authorization. The project needs to know which rule is applying the limit and how a destination that appears in a result or document is treated.

Prior to this update, explanations of previous behaviors could describe a different boundary between the environment network and web tools. A new implementation needs the current documentation, not a mirror or guide left behind. Verification must include the date of the source and the type of environment, so a correct instruction for another path is not applied by mistake.

The extension makes the design more readable, but still requires proof. An agent who fails to reach a source must distinguish the policy block from the absence of information. If it presents "not found" when the destination was actually banned, the operator can misinterpret the outcome and make a decision about an incomplete search.

What environments fall under the new behavior?

The documented perimeter concerns cloud limited environments. It should not be automatically extended to unrestricted or self-hosted, as required by reading the Managed Agents environment guide. In the project tab you must indicate which environment is used and who can change its configuration. The generic name of the product is not enough to describe the actual controls.

The availability of the beta and the conditions of the account remain separate checks. Italy is among the Countries supported by Anthropic, but this does not prove that a specific Managed Agents configuration has been activated or tested on your account. The project must avoid turning a general availability into a local operational guarantee.

How to choose domains without opening more than necessary?

The list should start from the sources required by the task. An agent checking data sheets may need approved supplier sites, not any page mentioning the same product. Each added domain should have an understandable reason and a responsible person who knows when to remove it. A list constructed by copying everything that appears in the documents quickly loses meaning.

The team must also consider secondary destinations, redirects and documents hosted elsewhere. You must not blindly widen the scope to eliminate an error. Examine the case, determine which source is actually needed and decide whether to allow it. The correction must remain tied to the task, preventing an occasional exception from becoming permanent access to a much wider area.

In the AI Agents for Companies This choice is part of the mandate. The question is not just where the system can go, but why it needs to go and what information it can bring back. A narrow perimeter makes it easier to control results, errors, and source changes.

Why can an authorized site contain unreliable instructions?

A page can host comments, attachments, or text published by different subjects. Even a source chosen by the company may contain non-relevant material or instructions that invite the agent to change behavior. The system must keep separate the mandate received from the content consulted. A sentence on the page does not authorize reading internal files, contacting other services or ignoring project limits.

Network restriction reduces some access possibilities, but does not replace this control. A hostile content can attempt to influence the response even without asking to open a new destination. For this the result should report sources and limits, while instruments with operational consequences must have independent permissions. Security does not depend on a single setting.

The Guide on AI and Data Security It faces this boundary in the full process. The pilot must verify that the external content is treated as information to be read, without becoming orders that modify accesses, recipients or criteria for completing the task.

Can a distributor consult only approved suppliers?

Hypothetical scenario. An Italian distributor wants to prepare technical comparisons using the cards of the suppliers he works with. The agent searches for features and conditions in authorized sources, then produces a draft with references. It does not purchase products and does not use unapproved reseller pages to automatically fill in missing information.

The sample includes a product on the correct site, one described only in an attachment and one for which there is no accessible source. The system must distinguish absent data, non-readable document and blocked destination. The operator decides whether to ask the supplier for clarification or to authorise a new source. The lack of information must not turn into an invented feature.

The useful metric can be the share of verified fields on the source, accompanied by requests for review and proposals out of perimeter. They are proposed evaluation criteria, not observed results. The value of the pilot lies in reducing the search by keeping it understandable where each data used in the commercial comparison comes from.

Can a service company monitor chosen institutional sources?

Second hypothetical scenario. An SME of services wants to collect updates from a set of institutional sites relevant to its business. The agent prepares an internal review and links each point to the source. It does not present the summary as regulatory advice and does not extend the search to blogs found in the results without a decision from the manager.

The test includes updated pages, historical documents, and links leading to an external archive. The system must report date and relevance, avoiding to treat a page still online as a necessarily in force provision. Network boundary helps choose sources, but content assessment and business use require specific responsibilities.

The manager checks that the missing information is visible and that the summary does not appear complete when a source has been blocked. If the work has important consequences, the review remains a tool to support reading. Automation can order the material, while applicability to the concrete case must be confirmed by those with the necessary expertise.

What to do when the agent encounters a new destination?

The flow should stop on the unauthorized passage and describe the need: what information is missing, what domain is being proposed and why it is relevant. The operator can approve a perimeter change or maintain the lock. A generic request for internet access is not useful, because it eliminates the very boundary that the project is trying to make controllable.

Any authorisation must be registered together with the reason and the person responsible. If the domain serves only one practice, the team must assess whether to keep it on the permanent list. An exception should not automatically propagate to all agents or projects. This prevents operational fixes from slowly turning a circumscribed list into an indistinct access.

The connection with internal systems requires a different assessment. The in-depth study on AgentCore Gateway and Private API with TLS It concerns the boundary between business tools and services. Allowing a web source and authoring an internal API are decisions with different consequences, even when they belong to the same stream.

What tests to perform before accepting the configuration?

The sample must include permitted and prohibited destinations, context URLs, and links discovered during the consultation. The behavior with empty list occurs, without assuming that it allows you to search anywhere: the documentation on web tools signals that this configuration can prevent results. Each outcome should be read along with the rule applied.

The test must also check the message returned to the operator. A correct but invisible block can produce an incomplete response presented as definitive. The agent must indicate that part of the task has not been performed and what verification is needed to continue. This makes it possible to decide without indiscriminately opening the network to make an error disappear.

The isolation verification remains distinct from the functional one. The GitHub Copilot local sandbox is about another environment, but it shows why tools, files, and networks deserve specific evidence. A successful example is not enough to prove that banned logins are really blocked.

How to connect network, browser and collaboration tools?

A project can use multiple paths: managed web tools, developer-provided browser, and business sources. Restrictions of one should not be automatically transferred to others. In Claude SDK browser and computer use, environment and operations remain to be implemented; the control map must then indicate where each limit is applied.

Access to collaboration documents also introduces content permissions. The expansion of Rovo with OpenAI, Jira and Confluence concerns the context of the team: a reachable document is not appropriate for this for any user. The project must maintain a distinction between technical reachability and the right to read or use the information.

The AI integration with existing systems benefits from a simple map of the steps. For each one, possible identities, destinations, data and actions are noted. This allows the complete process to be verified without attributing to a single setting an effect that is not documented.

Before adding a domain to the allowlist

Identify the task that the source requires and verify that the destination is the correct one. Check what content can be read and whether there are links to other areas. Decide who authorizes the addition and when to review it. Then repeat the test on one case allowed and one blocked, also observing how the agent describes the limit to the operator.

How to maintain the perimeter when changing sources?

Sources can move documents, change domains, or introduce a separate archive. The procedure must recognize these events without automatically converting them into a wider access request. If a destination stops working, the manager checks the new path and decides whether the source maintains the same value for the task. The mere fact that the site proposes a redirect does not resolve the assessment.

It is useful to keep a registry of configuration changes: domain added or removed, reason, project affected and person in charge. There is no need to turn it into a complex document. It is necessary to be able to understand why an agent today reaches a destination that was previously blocked, especially when an unexpected result emerges after an operational correction.

Authorised domains should also be reviewed when the task changes. An agent born to read data sheets could be reused to prepare commercial material; the relevant sources and consequences of the result are not necessarily the same. Reuse of the component must not drag an old perimeter without verification. Technical continuity must be accompanied by an updated mandate.

Finally, blocked cases can help improve the process. If the same information is often missing, it may be more useful to acquire it in a controlled internal archive than to continually broaden the search. The network boundary thus becomes a tool for choosing reliable sources, instead of a series of exceptions accumulated over time.

Control services and related tools

In his work with Claude Code, he HTTP Hooks have an input and response contract to verify: an error status does not automatically equal a blocking decision. The guide to Hooks and MCP Instead, it distinguishes the interception of a connected tool from the use of an MCP tool as a handler. They are different boundaries, to be controlled separately.

What mistakes weaken a seemingly restrictive policy?

Specific errors are using a too large list, viewing each link as authorized, applying instructions from one environment to another, and hiding the blocks in the final summary. Even opening a domain to quickly solve a single practice can become a problem if no one maintains the perimeter. The manager must be able to read the configuration and link it to the work entrusted to the agent.

A new price associated with this change has not been verified in the sources consulted. Costs of the model and the environment should be assessed separately. The useful decision concerns the control of sources: to define where a system can search and when it must stop, the design of AI agents may start with a reasoned list of destinations and a verifiable exception procedure.