Skip to main content
Managed agents are available on Enterprise. Free and Pro include Signal only. Through September 15, 2026, Signal and managed agents are included at no additional charge for Enterprise. See Pricing and usage.
This is the setup page for managed agents. Two things need connecting before a worker can do anything useful:
  • The harness — the agent runtime inside the sandbox, and the model credential that powers it.
  • Skills — the outside systems a worker is allowed to reach.
Both are configured once per account and reused across every agent.

​
The harness

The harness is the agent runtime that runs inside the sandbox. Claude Code is available today; Codex, Cursor, and others are on the roadmap. Claude Code needs an Anthropic credential, which Arize calls an agent integration. By default, runs use the Arize-managed credential and you configure nothing. On Enterprise you can bring your own key instead:
1

Add an Anthropic AI Provider

Under Settings → AI Providers, add an Anthropic provider with your key.
2

Allow it in agents

Enable Allow use in agents on the integration, or add it from More → Agent Integrations with Add Agent Integration.
3

Select it

Choose that integration on a preset, during agent setup, when enabling Signal, or as the space default under Space Settings.
Manage available integrations under More → Agent Integrations. Enterprises that must not use Arize-managed models can ask Arize to disable the Arize-managed integration for the account, so only customer-owned keys are ever used.

​
Skills

Skills are account-level integrations that give sandbox workers access to external systems. You connect them inline while setting up an agent — the Connect step of the guided setup — and a skill you save is then available to every preset in the account.
These are not the same as Arize Skills, which run in your own coding agent on your own machine. Same idea, different runtime: these inject credentials into an Arize-managed sandbox.

​
GitHub

Lets a worker clone a repo, branch, and open PRs. Secret: GH_TOKEN — a personal access token or GitHub App token with the scopes your workflow needs. Once a GitHub skill is attached, set the repository the worker should use. For Signal, attach the skill and repo from Configure Signal on the project.

​
Arize

Optional. Workers already have read access to traces in the project you selected, without this skill — Arize provisions a short-lived credential scoped to that project when a run starts, which covers investigations, Signal, and other trace-only work. Add an Arize skill only to expand what a worker can do:
  • Query or update datasets and experiments
  • Create or run evaluators
  • Apply annotations or manage other resources through the API
Secret: ARIZE_API_KEY. The worker can only call what that key allows, so use a dedicated least-privilege key rather than a personal admin key.

​
Datadog

Lets a worker query Datadog alongside Arize traces. Secrets: DD_API_KEY, DD_APP_KEY, and optionally DD_SITE (defaults to datadoghq.com).

​
Custom skill

Installs a skill from a GitHub repository into the sandbox — an internal runbook, or a fork of an Arize skill. Custom skills may declare optional env vars. Every non-custom provider requires at least one secret.

​
Add a skill

1

Start agent setup

Launch an agent from Signal & Agents → + New Agent. The Connect step lists the skills that agent needs.
2

Choose a provider

GitHub, Arize, Datadog, or Custom skill.
3

Enter secrets

Paste them as ENV=value lines or a JSON object. The form shows which env vars it will store.
4

Save

The skill becomes available to every preset in the account. For GitHub, set the repo after saving.

​
What a worker can reach

That access is limited to the project you selected, and to what your own space and project permissions already allow. An attached Arize skill adds exactly what its key permits and nothing beyond it. Each run gets a dedicated sandbox that is torn down when the run ends. Agent execution is traced, so you can audit tool use and outputs from the run’s detail view.

​
What a worker cannot do

  • Serve as your customer-facing production runtime. Managed agents improve systems you observe in Arize; they do not replace your app.
  • Change production without review. Code lands as a PR that you merge.
  • Reach any project or space other than the one selected for the run — or anything your own permissions exclude, whichever is narrower.

​
Permissions

Account Admins grant managed-agent permissions on custom roles at the space level. Under legacy space roles, Space Member+ maps to full managed-agent access, and Read-only can view Signal issues but not agent jobs or transcripts. Annotators cannot manage skills, presets, or agents. Inside a running sandbox, workers use a fixed Managed Agent role today. Per-agent roles you can attach to a preset are on the roadmap.

​
Security practices

  • Least privilege — read-only GitHub tokens until you actually need PRs; Datadog keys scoped to the APIs in use.
  • One skill per integration — reuse a skill across presets rather than duplicating secrets.
  • No secrets in prompts — credentials belong on the skill or the AI Provider integration. Skill secrets are encrypted at rest and injected into the sandbox only for the run.
  • Trust your install sources — the sandbox clones and executes custom skill code during a run.
  • Review outputs — treat PRs and investigation suggestions as untrusted automation output until a person has read them.