Claude Managed Agents got web domain allowlists on 20 August 2026, and the Console org list does not apply

Summary. On 20 August 2026 Anthropic added allowed_domains and blocked_domains to the web_search and web_fetch entries of the Claude Managed Agents toolset. The documentation attaches four constraints the release note does not: each list holds at most 64 entries, a web_fetch entry cannot include a path, max_uses and citations are unavailable on Managed Agents, and, most consequentially, the organization-level domain restriction an administrator sets in the Claude Console applies to Messages API requests only. Managed Agents sessions use nothing but the per-tool lists on the agent. A blocked web_fetch returns an error the agent can see. A blocked web_search result is silently omitted. Web search costs $10 per 1,000 searches plus token costs; web fetch adds no charge beyond tokens.

If a security team believes one Console setting governs every Claude surface, that belief is wrong for the surface that runs unattended. The only spend backstop is the session budget Anthropic shipped on 7 August 2026, and it stops a session rather than capping it exactly.

What shipped

The Claude Platform release notes for 20 August 2026 record the change: you can now restrict which sites a Claude Managed Agents agent's web_search and web_fetch tools reach, by setting allowed_domains or blocked_domains on the tool's entry in the agent_toolset_20260401 configs array. The same entry accepts max_content_tokens for web_fetch and user_location for web_search.

The Managed Agents tools page describes the runtime behaviour. allowed_domains means the tool can reach only those hosts; blocked_domains means it can never reach them. Each tool carries its own list, so search and fetch can be restricted differently. A listed domain covers that host and all of its subdomains.

Then the asymmetry. A web_fetch call for a URL the lists do not permit returns an error result to the agent, with is_error: true on the agent.tool_result event and an error code of url_not_allowed. A web_search call does not error. It omits the results the lists do not permit. The agent receives a shorter result set and no signal that anything was filtered.

That distinction matters for anyone writing agent evaluations. A fetch denial is observable and testable. A search omission looks identical to a query that found nothing.

The Console setting does not reach agent sessions

The web search tool documentation states it directly: organization-level settings in the Claude Console apply to Messages API requests only, and Claude Managed Agents sessions use only the per-tool allowed_domains and blocked_domains lists on the agent toolset.

Set against how tightly the Console list binds Messages API traffic, that is a wide gap. On the Messages API, per the server tools documentation, a request-level allowed_domains must be a subset of the organization-level allowed list, entries outside it cause a validation error, and a request-level allowed list that includes a domain the organization blocks is rejected with a 400 error naming the conflicting entries.

None of that enforcement exists for a Managed Agents session. The agent's own configs array is the whole policy.

Control	Messages API	Claude Managed Agents
Console organization-level domain restriction	Applies, and request lists must be a subset of it	Does not apply
Per-request or per-tool allowed_domains and blocked_domains	Available on the tool object	Available on the toolset configs entry
Maximum entries per list	Not stated	64
Path entries in the list	Supported for web search, ignored by web fetch	Not permitted for web fetch
max_uses, citations, cache_control	Available	Not available
Conflicting request and organization lists	400 error naming the entries	No organization list to conflict with

Rules that trip people up

The matching rules are the same fields with different behaviour per tool, and they are easy to get wrong in a policy review.

Domains carry no scheme. Write example.com, not https://example.com. Invalid formats are rejected at request time with a 400 invalid_request_error.

Subdomains are automatically included. example.com covers docs.example.com. Listing a specific subdomain narrows rather than widens: docs.example.com returns only that subdomain, not example.com or api.example.com.

Paths work for one tool and not the other. Subpaths are supported for web search and match anything after the path, so example.com/blog matches example.com/blog/post-1. Web fetch matches on the domain only, and an entry that includes a path never matches a web fetch URL. On Managed Agents the rule is stricter still: domains listed for web_fetch cannot include a path at all.

Wildcards are not allowed in the domain, only in the path after it.

And the two lists are mutually exclusive. You can use allowed_domains or blocked_domains, not both in the same request.

There is one more guardrail that predates this change and still applies. The web fetch tool can only fetch URLs that previously appeared in the conversation context; a URL that did not returns url_not_in_prior_context. The url_not_allowed code covers domain filtering, private addresses and robots.txt restrictions together, so a denial does not tell you which of the three fired.

The cost side

Two different pricing models sit behind these two tools, which is worth knowing before you widen an allowlist.

Tool	Charge	Token treatment
web_search	$10 per 1,000 searches	Search-generated content counted as input tokens in the same turn and in later turns
web_fetch	No additional charge	Fetched content billed as standard input tokens
max_content_tokens on web_fetch	No charge	Truncates text content, limit is approximate
Binary content such as PDFs	No charge	max_content_tokens does not apply to it
Managed Agents session budget	No charge	Hard cap priced at public list rates

Two of those rows are traps. max_content_tokens is documented as approximate, so actual input tokens can vary by a small amount around your ceiling. More importantly, the limit applies to text content and not to binary content such as PDFs, so an allowlisted domain that serves large PDFs can push an agent's token consumption past the figure you set.

The backstop is the session budget Anthropic shipped on 7 August 2026: a hard spend ceiling priced at public list rates that pauses the session with a budget_reached stop reason. The budgets documentation notes that the request in flight when the cap is crossed still finishes, so the final list cost can land a fraction past the budget. A budget is a stop, not a precise limit. Our earlier analysis of Claude session budget list cost covers that behaviour in detail.

What to do this week

Inventory which Claude surfaces your organisation actually runs. If the answer includes Managed Agents, the Console privacy settings page is not your control plane for those sessions, and any compliance statement that says otherwise needs rewriting.

Move the domain policy into the agent definition and into version control. Since the list is capped at 64 entries and allowed_domains and blocked_domains are mutually exclusive, an allowlist strategy forces a real decision about which 64 hosts an autonomous agent may reach. That is a healthier conversation than an open blocklist, and it is the same reasoning behind our AI agent governance layers approach.

Add an evaluation for silent search filtering. Because web_search omits rather than errors, an agent whose allowlist is misconfigured will look like an agent that cannot find anything. Test with a query whose only good answer sits on an allowlisted host, and a second whose only answer sits off it, and assert on the difference.

Treat the allowlist as a prompt-injection control, not only a data-egress control. Every domain you allow is a domain that can put text into the agent's context. The narrower list is the smaller attack surface, which is the same argument in our guide to AI agent prompt injection guardrails.

India-specific considerations

For Indian teams operating under DPDP (Digital Personal Data Protection Act 2023), the egress question is usually framed as where personal data can go. A blocked_domains list is the weaker answer, because it permits everything not named. An allowed_domains list of at most 64 hosts is the defensible one, and it is now the only mechanism available for Managed Agents sessions, since the Console-level restriction does not apply to them.

Budget the search line separately. At $10 per 1,000 searches, an agent fleet that runs a few hundred thousand searches a month is a five-figure dollar line before token costs, which changes the build-versus-buy maths covered in our agent web search API cost comparison.

What is still unknown

Anthropic has not said whether the Console organization-level domain restriction will be extended to Managed Agents sessions, and has not published a per-Region or per-workspace variant of the per-tool lists. The 64-entry cap is documented without a stated path to raise it. Until that changes, treat agent-level configuration as the only enforcement point for Managed Agents web access.

FAQ

What did Anthropic add to Claude Managed Agents on 20 August 2026?

Per-tool domain filtering. You can set allowed_domains or blocked_domains on the web_search and web_fetch entries of the agent_toolset_20260401 configs array, so each tool carries its own restriction. The same entries also accept max_content_tokens for web fetch and user_location for web search.

Does the Claude Console organization domain setting cover agent sessions?

No. The web search documentation states that organization-level Console settings apply to Messages API requests only, and that Claude Managed Agents sessions use only the per-tool allowed_domains and blocked_domains lists on the agent toolset. The agent definition is the sole enforcement point for those sessions.

How many domains can each list hold?

At most 64 entries per list on Claude Managed Agents. The server tools documentation states the cap alongside two other Managed Agents restrictions: domains listed for web_fetch cannot include a path, and Messages API fields such as max_uses, citations and cache_control are not available on the agent toolset.

What happens when the agent hits a blocked domain?

It depends on the tool. A web_fetch call for a disallowed URL returns an error result with is_error true on the agent tool_result event and the error code url_not_allowed. A web_search call returns no error at all; it simply omits the disallowed results, so the agent cannot tell filtering occurred.

Can I use allowed_domains and blocked_domains together?

No. The documentation states you can use either allowed_domains or blocked_domains, but not both in the same request. Domains carry no HTTP or HTTPS scheme, wildcards are not permitted in the domain itself, and invalid formats are rejected at request time with a 400 invalid_request_error.

Do subdomains and paths behave the same way?

No. A listed domain automatically covers its subdomains, so example.com covers docs.example.com, while listing docs.example.com narrows to that subdomain only. Subpaths work for web search and match anything after the path, but web fetch matches on the domain only and ignores any path entry.

What do the web tools cost?

Web search costs $10 per 1,000 searches on the Claude API, plus standard token costs for search-generated content, which counts as input tokens in the same turn and in later turns. Web fetch carries no additional charge beyond the standard token cost of the fetched content it adds to context.

Does max_content_tokens cap the cost of a fetch?

Only partly. The documentation describes the limit as approximate, so actual input tokens can vary by a small amount. It also applies to text content and not to binary content such as PDFs, so an allowlisted host serving large PDF files can carry an agent past the ceiling you configured.

How eCorpIT can help

eCorpIT is a CMMI Level 5 and ISO 27001:2022 certified engineering organisation in Gurugram, and our senior-led AI teams build the enforcement layer that agent platforms leave to you. For Claude Managed Agents that means holding the 64-entry allowlist in version control next to the agent definition, writing evaluations that catch silent search filtering, and pairing the domain policy with a session budget so a misconfiguration is bounded in dollars. Our AI agent security guardrails service covers that work end to end, and you can book an agent governance review to start with your current toolset configuration.

Further reading on this pillar: enterprise AI agents in production.

References

1. Claude Platform release notes, Anthropic
2. Tools for Claude Managed Agents, Anthropic
3. Server tools, Claude Platform documentation
4. Web search tool, Claude Platform documentation
5. Web fetch tool, Claude Platform documentation
6. Session budgets for Claude Managed Agents, Anthropic
7. Claude Managed Agents overview, Anthropic
8. Permission policies for Claude Managed Agents, Anthropic
9. Claude Managed Agents sessions, Anthropic
10. Tool use with Claude, Claude Platform documentation
11. Claude API pricing, Anthropic
12. Tool reference, Claude Platform documentation

Last updated: 22 August 2026.