Claude managed agents pricing exposes the real cost of scale

At a glance

What this is: This is a pricing analysis of Claude Managed Agents that shows the runtime fee is only part of the total cost once agents, tools, and governance overhead scale.

Why it matters: It matters because IAM, PAM, and NHI teams must understand how agent runtime, credential scope, and observability change when AI workflows move from single sessions to production fleets.

By the numbers:

• Claude Managed Agents adds a $0.08 per active session-hour runtime fee on top of token charges.
• Claude Opus 5 input tokens cost $5 per million and output tokens cost $25 per million.
• Claude Sonnet 5 input tokens will cost $3 per million from Sep. 1, 2026, with output tokens at $15 per million.
• Claude Managed Agents does not apply the 50% batch discount that standard Messages API calls can receive.

👉 Read TruFoundry's breakdown of Claude Managed Agents pricing and scale trade-offs

Context

Claude Managed Agents pricing looks simple at first glance because it combines token billing with a session runtime charge. The governance gap is that teams often budget for model usage alone and miss the operational costs tied to session duration, tool calls, and control-plane overhead.

For identity teams, the more relevant question is not whether the agent can run, but what access model, credential handling, and auditability are required once many sessions are active at the same time. That shifts the conversation from model pricing to NHI governance and agent lifecycle control.

Key questions

Q: How should security teams budget for AI agents that have both token and runtime costs?

A: Security and platform teams should model token spend, session runtime, and tool usage as separate cost drivers, then tie all three to a named owner and an expiry condition. That gives finance a realistic forecast and gives identity teams a governable boundary for sessions that behave like non-human identities.

Q: Why do AI agents create a governance problem for IAM teams?

A: AI agents create a governance problem because they authenticate and act as autonomous software entities with tool access. If their actions are logged only as application activity, teams lose accountability, context, and revocation clarity. IAM must therefore extend to agent identity, delegated authority, and control-plane audit trails.

Q: What breaks when AI agent access is reviewed only after the fact?

A: After-the-fact review leaves a gap between action and containment. If an agent can already reach a dataset, API, or SaaS system, the damage may be done before a human sees the alert. Runtime checks reduce that gap by stopping unauthorized actions before they execute.

Q: Who should own governance when AI agent sessions become expensive and persistent?

A: Ownership should sit across platform engineering, IAM, and the business team using the agent, because no single group sees the full picture. Platform teams manage runtime, IAM manages credentials and access, and the business owner must justify continued use and scope.

Technical breakdown

How Claude Managed Agents billing is split between tokens and runtime

Claude Managed Agents bills on two separate meters. Token usage follows the normal Claude API model pricing, while the session itself accrues a flat runtime charge while it is in a running state. Idle periods, termination, and rescheduling do not count toward runtime billing. This creates a cost model that is easy to underestimate if teams only look at prompts and completions. For platform teams, the practical issue is that billable time now tracks agent state, not just model inference.

Practical implication: Track token burn and session duration separately so budget estimates match production behaviour.

Which Messages API discounts do not carry over to managed sessions?

Several cost optimisations that exist on the Messages API side do not transfer into managed sessions. Batch pricing, fast mode premiums, and data residency multipliers are tied to request patterns that do not map cleanly to stateful agent sessions. Web search still adds its own charge, and code execution costs are folded into runtime instead of appearing as a separate line item. The result is a billing model that changes once an agent becomes persistent and interactive rather than request driven.

Practical implication: Rebuild unit economics around the managed-session model instead of assuming Messages API discounts still apply.

Why multi-agent operations turn pricing into a governance problem

The key architecture issue is that cost and control are now coupled to session state, credential scope, and tool usage. Once multiple agents run concurrently, the driver of spend is no longer a single prompt but the combination of active sessions, external tools, and the length of time those sessions stay open. That makes observability part of financial control, not just debugging. It also means IAM and NHI governance need to account for which tools an agent can call and when those sessions can persist.

Practical implication: Use per-session tracing and tool-level logging to connect spend spikes to specific actions and identities.

Threat narrative

Attacker objective: The objective is not traditional compromise but uncontrolled cost and opaque agent behaviour across a growing session fleet.

1. Entry occurs when a team provisions a managed agent session with access to tools, external search, or code execution capabilities.
2. Escalation occurs when the session stays active longer than expected and accumulates token and runtime charges through repeated tool use.
3. Impact occurs when unmanaged session growth produces spend overruns, opaque tool activity, and weak accountability across agent operations.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Managed-agent pricing is really NHI lifecycle pricing in disguise: once a session can persist, call tools, and consume resources independently, the billing model becomes inseparable from identity governance. Teams are no longer pricing an inference call, they are pricing a governed runtime that behaves like a non-human identity with an operational lifecycle. The practitioner implication is that finance, platform, and IAM teams need one shared control model for sessions, tools, and credentials.

Per-session billing exposes the identity blast radius of agent sprawl: the issue is not only spend, but uncontrolled replication of agent sessions across teams and use cases. Each session can carry its own access context, traces, and tool dependencies, which multiplies the audit problem as fast as it multiplies the cost problem. This is where agent inventory, entitlement review, and runtime monitoring converge.

Standing assumptions about access ownership break down when agents are continuously active: access review was designed for identities that hold privileges long enough to be observed and recertified. That assumption weakens when agent sessions, tool calls, and delegated credentials become short-lived, repeated, and distributed across many runs. The implication is that governance must move from periodic review of static access to control of session-bound authority.

Runtime governance gap: the real control failure is not a missing price list, but the absence of a unified policy layer linking model choice, tool access, credential handling, and observability. A pricing model that hides operational complexity in different meters forces practitioners to reconstruct governance after the fact. The practical conclusion is that cost control and identity control now need to be designed together.

Model-level budgeting is now an identity security control, not just a FinOps feature: when different agents can trigger very different downstream spend and data access, cost allocation becomes a proxy for governance accountability. That is especially true where tool calls can fan out into MCP traffic, code execution, or external search. Practitioners should treat budget boundaries as part of the access boundary.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That same research shows 92% agree governing AI agents is critical to enterprise security, which makes OWASP NHI Top 10 a useful next step for control design.

What this signals

Runtime billing will push agent governance into the same operating model as NHI management. Once sessions are metered by duration as well as tokens, organisations need a control plane that can connect identities, tools, and spend. The most durable pattern is to treat managed agents as governed workloads, not interactive chat sessions.

Agent cost spikes are often identity problems in disguise. When an agent suddenly becomes expensive, the root cause is frequently uncontrolled tool fan-out, overbroad access, or a session that should have been terminated earlier. Teams that already track NHI inventory and lifecycle are better placed to spot the difference between legitimate workload growth and governance drift.

With 80% of organisations already seeing AI agents act beyond intended scope, according to AI Agents: The New Attack Surface report, the next governance gap is not awareness but control enforcement across runtime, credentials, and audit trails.

For practitioners

• Build separate budgets for tokens, runtime, and tools Model the total cost of ownership as three lines, not one. Include token usage, active session-hours, and any external tool charges so long-running agents do not distort forecast accuracy.
• Inventory every managed agent session as an identity object Treat each running session as a governed non-human identity with explicit owner, purpose, and expiry conditions. Tie the inventory to access reviews, cost attribution, and offboarding.
• Centralise tool and credential control outside agent definitions Keep API keys, OAuth tokens, and provider credentials in a gateway or vault layer instead of embedding them in agent configs. That reduces credential spread and makes rotation and revocation measurable.
• Trace spend to tool calls and sub-agent behaviour Use end-to-end tracing to show which tool call, model step, or sub-agent caused a cost increase. Without that linkage, teams cannot distinguish legitimate workload growth from governance drift.

Key takeaways

• Claude Managed Agents pricing looks simple until session runtime, tool charges, and discount exclusions are added to the model.
• For IAM and NHI teams, the bigger issue is governance of agent sessions, credentials, and observability rather than token billing alone.
• Enterprises should treat managed agents as governed identities with lifecycle, budget, and audit boundaries, not as isolated application features.

Key terms

• Managed Agent: A managed agent is a software identity that performs tasks on behalf of an organisation and must be governed like any other non-human identity. In practice, it needs an owner, a defined access scope, and reviewable entitlements so its actions can be traced and controlled.
• Session Runtime Fee: A session runtime fee is the charge applied while an agent remains actively running, separate from model token usage. For practitioners, it matters because cost now tracks session state and duration, which makes governance, termination, and idle-state handling part of financial control.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• NHI Credential Lifecycle: NHI credential lifecycle is the end-to-end governance of machine credentials from creation through use, review, rotation, and retirement. It matters because service accounts, tokens, and certificates can remain active long after a team believes they have been controlled.

What's in the full article

TruFoundry's full article covers the operational detail this post intentionally leaves for the source:

• Line-by-line cost examples for one-hour and high-volume agent sessions across different models
• Comparative discussion of TrueFoundry Agent Harness versus Claude Managed Agents for multi-agent deployments
• Deployment, observability, and credential-handling details for teams running agents at scale
• Platform-level considerations for self-hosted, on-premises, and managed SaaS deployment choices

👉 The full TruFoundry article covers the per-session math, deployment trade-offs, and governance details behind managed agents.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.