An agent's final message is only one piece of a run. To audit an existing Claude Managed Agents session, an authorized operator needs to connect that message to the exact agent version, the work recorded in its events, the environment and credentials it could use, the resulting changes, and the session's consumption. This guide produces one decision for one session: healthy, action required, or hold. It follows Anthropic's current beta documentation, checked on 23 October 2026; BIG CHANGE did not inspect a provider account or run an agent.
The big change
- What changed: Anthropic's session viewer and usage record put events, threads, resources and session cost within reach of an operator.
- Why it matters: A status label or plausible output cannot establish what child work completed, what an external service received, or what credentials the run could use.
- What to watch: Limited networking can still permit configured MCP endpoints and package hosts beyond
allowed_hosts; the session's list cost is an estimate, not the invoice.
Before you start
You need an existing Managed Agents workspace, the exact session ID, and Developer or Admin access to its Console session viewer, or a redacted readback from someone with that access. Obtain the owner's approved agent/version, task, environment, allowed data, expected outputs and external effects, credential/user scope, spend threshold and evidence-retention location. A team should decide who may inspect sensitive transcripts and who may authorize a repair before reading the run. If those inputs are missing, record a hold rather than guessing from a session title.
The Console route is useful for session inspection. Configuration and billing may require the owner's authorized read-only Console, API or CLI access and an independent service readback. These are separate evidence sources; the documentation does not promise one dashboard control for every environment, vault and invoice. The API requires the account's Managed Agents beta access and its documented managed-agents-2026-04-01 header when used without an SDK. Keep credentials in the owner's approved tooling. This procedure does not require a new agent run, a paid test, or any BIG CHANGE provider account.
Copy the blank record below into an approved private location. Put event IDs, timestamps, resource IDs and redacted evidence links in it. Never paste secret values, complete private transcripts or user data into a public copy.
1. Identify the exact session
Open Sessions in the Claude Console in the correct workspace and select the exact session ID. Record the displayed agent, version, environment, creation time, current status and stop reason. Compare each with the owner's task record. If the session is missing, check workspace and role. The session operations documentation also provides sessions.retrieve(session_id) and paginated sessions.list(agent_id=...); follow next_page before concluding a session is absent. Use an authorized read-only API route when the Console view omits a needed field. Save the actual session URL or resource ID, not a lookalike session title.
Expected result: one session and its intended agent/version/environment are identified. A mismatch is a hold until the owner establishes which workload ran.
2. Reconstruct work and effects
In the session viewer, read the timeline and Events for the initiating task, tool requests and results, errors, output and final stop reason. The Tools view shows configured tools, calls and failures; Threads shows each thread's status and usage; Resources shows mounted files, repositories, memory and session output. Record relevant event IDs and times. If the event stream disconnected, use the documented past-event readback and pagination rather than treating the gap as proof that no event occurred.
Check every workflow run and child thread that contributed to the task. An idle primary session can have unfinished work; rescheduling is a retry state; terminated says the session ended, not that its task succeeded. A workflow may report completion despite a failed child. If the session stopped at budget_reached or is waiting for a tool confirmation, record the pending decision. Read the actual output file or returned result. For any claimed write, send, deployment or other external effect, ask the authorized owner to read the destination service and compare its target and revision with the event. A model statement or attempted tool call is not an external readback.
Expected result: each relevant run and child has an observed outcome; the approved output and every material external effect are checked or explicitly unresolved. Do not archive or delete the session to make a warning disappear: deletion can remove its events and produced files.
3. Determine the access the session actually had
Compare the session's environment ID and type with the approved record. A cloud environment describes a sandbox configuration, and each session gets an isolated sandbox. Read the effective configuration for the audited work, including its packages and all four networking fields: networking.type, allowed_hosts, allow_mcp_servers and allow_package_managers. For limited networking, an absent host list allows no hosts unless a documented exception applies; allow_mcp_servers and allow_package_managers each default to false. An absent field is a default only where the current documentation establishes it. Preserve the actual field values and the source/revision/time of the readback. Anthropic does not promise a versioned environment snapshot, so if a later configuration read cannot establish what applied during the work, mark that portion hold and obtain the owner's deployment/configuration record.
For limited networking, examine three routes together: explicit allowed_hosts; MCP server endpoints configured on the agent and on agents it could delegate to when allow_mcp_servers is true; and Anthropic's maintained registry/code-host set when allow_package_managers is true. The latter two can reach beyond the explicit host list. When MCP allowance is false, a configured MCP host outside allowed_hosts can reject session creation, including through a delegated agent. A package allowance does not mean an arbitrary internet host is open. Neither exception adds hosts to web_search or web_fetch; those tools still follow allowed_hosts under limited networking. A host grant permits requests that can write as well as read. Compare each reachable host and tool with the owner's approved scope, rather than calling an endpoint safe because this inspection is read-only. Cloud environment networking spells out these rules. If the environment is self-hosted, inspect its actual host/network controls under the self-hosted documentation; do not apply cloud defaults to it.
Read the agent's effective tool and MCP configuration, including session-time changes, and list the exact endpoint URLs for the primary and delegated agents. Then compare vault IDs attached to the session with the owner's credential map. Vault credentials are workspace-scoped: an API key with workspace access can reference a vault when creating a session. Record credential metadata only: credential type, intended user, MCP URL or allowed host, environment-variable name and injection scope, rotation owner, and expected use. Secret values are write-only in API responses and do not belong in an audit record. MCP credentials match server URLs; inspect the connection and authentication events as well as the MCP connector rules. A session can start but report an MCP authentication failure. A vault label alone does not prove use: correlate attachment, endpoint, call event and, where relevant, the external service's own record.
This is observation, so do not run ant apply environment.yaml: that command creates or updates an environment. If effective reach or credential scope at work time cannot be established, hold. If a wrong endpoint, user or host appears, preserve the session evidence and route the smallest reviewed repair to its owner before further external action.
4. Reconcile usage, cost and budget
After the relevant turn settles, retrieve the session's cumulative usage or its last session.usage event. Record the read time; input and output tokens, cache reads and creation, server-tool requests, active_seconds, and usage.list_cost. Anthropic defines list_cost.amount as a string of whole USD cents: "187" means $1.87, not $187. The session's active_seconds counts overlapping thread activity once. Use the session usage.list_cost as the whole-session estimate. Thread figures help locate consumption, but exclude session running-time cost and round independently; they need not add to the session total. Do not force a reconciliation by double-counting concurrent runtime. Usage definitions explain these fields.
Read whether a session budget was set at creation and compare its cap with cumulative list cost and the session stop reason. One budget is shared by all threads in that session; it is not a workspace cap. An in-flight request can finish slightly past the limit. A session created without a budget cannot gain one later, and removing an existing cap cannot be undone for that session. Do not change the cap just to finish an audit. If a thread is paused at the cap while another awaits action, inspect both states. List cost uses public rates; the account's billing record is the source for an actual charge. The session viewer does not establish a generic per-agent alert switch.
Expected result: the record has a timestamped whole-session cost in cents, supporting thread figures, cap/stop context, and a separate billing readback or a clear statement that billing access is pending.
5. Make and verify the decision
Mark healthy only when the session identity matches approval; all relevant runs and children have reconciled outcomes; output and material external effects have independent readbacks; effective network and credential reach match authorization; and the owner's spend threshold is met. Mark action required for an established failed child, MCP connection, mismatched scope, stopped budget or unexplained cost, naming the event, target, owner and smallest authorized next step. Mark hold where identity, work-time configuration, permission, output, external effect or cost cannot be established. A blank cell in the record is pending, never a pass.
After an authorized repair, fresh-read the affected configuration or service and repeat only the affected session/event/output/access checks. An environment edit changes a later session's reach; it cannot change what the audited session already did. Keep old and new session IDs distinct. If an API request or repair response is uncertain, inspect the resource before retrying a write. Retain evidence under the owner's policy. This one-session audit does not activate monitoring or alerts.
Blank one-session audit record
Copy this table and its fields into a private record. Replace Pending only with observed evidence or an explicit unresolved reason.
Field | Reader entry |
|---|---|
UTC audit time, operator and approval | ___ |
Workspace, permitted data and evidence location/retention | ___ |
Owner-approved agent ID/version, task, output, external effects and spend threshold | ___ |
Exact session ID, Console URL, creation time, status and stop reason | ___ |
Expected/actual environment ID and cloud or self-hosted type | ___ |
Expected/actual attached vault IDs and credential metadata; no values | ___ |
Billing readback owner/date or pending reason | ___ |
Check | Expected from owner | Observed evidence ID/time and actual value | Verdict |
|---|---|---|---|
Session identity, agent version and stop reason | ___ | ___ | Pending |
Main run and every relevant child/thread ending or error | ___ | ___ | Pending |
Tool requests/results and independent external effect readback | ___ | ___ | Pending |
Output files/content and unresolved work | ___ | ___ | Pending |
Environment packages; | ___ | ___ | Pending |
Primary and delegated MCP endpoints; package-host reach beyond allowed hosts; | ___ | ___ | Pending |
Vault attachment, intended user, MCP URL/credential host/injection scope, connection errors | ___ | ___ | Pending |
Tokens, cache, server tools, session active seconds and authoritative | ___ | ___ | Pending |
Existing session cap, stop reason, owner threshold and separate invoice check | ___ | ___ | Pending |
Decision: Healthy / Action required / HOLD — ___
Smallest authorized repair, owner, target and expected readback: ___
After-repair resource/session ID and repeated check: ___
Sources and limits
The steps use Anthropic's current session viewer and usage, session operations, cloud networking, vault, MCP, budget and production monitoring documentation, checked 23 October 2026. Beta controls and account permissions may change. This is a documented procedure, not a BIG CHANGE test of a live session, vault, invoice, external effect or alert. For a separate workflow-building task, see our parallel document review guide; its output checks do not replace this session-wide audit.
