Managed agents vs governed missions
September 2026 was the month every major lab shipped a managed agent runtime. That's a triumph of infrastructure — and it answers a different question than the one production deployments ask. Managed runtimes answer how the agent runs. They don't answer whether it should have acted. Here's the framework for evaluating any agent platform, from any vendor, against the five things production actually requires.
What each layer actually provides
🤖 The managed runtime
The vendor operates the machinery: session and context management, tool use, subagent coordination, execution environments (hosted sandboxes, your VPC, or third-party providers). OpenAI's Agents API — public beta since September 10, 2026, on the Codex harness — is the clearest example; Meta's enterprise agent platform (announced September 28) is the enterprise-channel counterpart. You describe the task; they run the loop.
⚖️ The governance layer
Your architecture decides what's allowed: a contract declaring scope, value, cost, and risk bounds; a tenant boundary; a verified identity; deterministic policy authorization — models propose, models never decide; governed execution; and an evidence timeline comparing expected vs. actual. No vendor runtime provides this, because it can't: only you know what your business is allowed to do.
These are not competitors — they compose. The strongest architecture runs a managed runtime underneath a governance layer: the vendor's harness does the doing, your policy does the allowing, and the evidence trail records both. "Managed vs. governed" is a false choice; "managed without governed" is the actual risk.
Five checks for any agent platform
Run every agent platform — managed or self-built, from any vendor — through these five. A platform that fails one isn't disqualified; it's disqualified for the workloads that need that check.
| # | Check | The question | Why it matters |
|---|---|---|---|
| 1 | Authorization path | Who approves each action — and is a model anywhere in that decision? | A model that both proposes and approves its own actions has no control plane. Deterministic policy, reproducible verdicts. |
| 2 | Tenant isolation | Can one tenant's data ever reach another's context, tools, or evidence? | Multi-tenant agents without enforced isolation are a breach waiting for a prompt injection. Isolation must be structural, not prompt-based. |
| 3 | Evidence trail | Is every step inspectable and replayable — tool calls, context carried, subagent decisions? | No trail, no audit, no debugging, no defensibility. Long sessions without trails are unmanageable by definition. |
| 4 | Cost bounds | Can spend be bounded per task, per stage, per tenant — and enforced? | Tool loops are open-ended. Unbounded agents underwrite whatever the model attempts. See cost per task. |
| 5 | Recovery semantics | When a long run fails midway, what resumes, what's retried, what's explicit? | Durable work needs explicit recovery — silent retries corrupt, silent drops lose. This is why durable workflows exist. |
How the current platforms score
Applied honestly, the September 2026 landscape looks like this: managed runtimes score strongly on execution (sessions, tools, sandboxes, subagents — the harness problem is genuinely hard, and vendors are solving it) and leave all five governance checks to you. That's not a criticism; it's the product boundary. The vendors sell capability and convenience. Authorization policy, tenant boundaries, evidence, cost enforcement, and recovery semantics are your architecture — because they encode your business's permissions, data, and risk tolerance, which no vendor can know.
The practical consequence: adopt managed runtimes fast, and build the governance layer deliberately. The teams that get this wrong will do one of two things — refuse managed infrastructure and rebuild harnesses by hand (slow, expensive, worse), or adopt it with no governance layer and discover the missing five checks during their first incident (fast, then catastrophic). The third path — managed execution under deterministic governance — is what governed missions are: contracts, tenant boundaries, verified identity, policy authorization, durable execution, evidence. Whatever the keynote announces today, evaluate it against the five checks before it touches production.
Frequently asked questions
What is a managed agent runtime?
A vendor-operated layer that runs agents: sessions, context, tools, subagents, sandboxes. Examples: OpenAI's Agents API (public beta since September 2026) and Meta's enterprise agent platform (announced September 2026).
What is a governed mission?
Work executed inside an explicit chain: contract, tenant boundary, verified identity, deterministic policy authorization, governed execution, evidence timeline. Models propose and execute; they never authorize.
Do I have to choose between them?
No. Run managed runtimes underneath a governance layer. The false choice is "managed vs. governed" — the real risk is "managed without governed."
What do I check before production?
Authorization path, tenant isolation, evidence trail, cost bounds, recovery semantics — the five checks above.
Build on the framework
🤖 Agents API guide
The managed runtime this framework evaluates — what OpenAI's Agents API covers.
🧭 Model routing
Which model runs inside the harness: Astra vs Sol vs Luna, routed by stage.
How this comparison is verified
The OpenAI side of this comparison reflects the Agents API public beta (September 10, 2026) as described in OpenAI’s launch materials and developer documentation — managed Codex harness, durable sessions, sandbox choice, and token/tool-based billing. The MasterEngine side reflects MasterEngine’s published governed-execution design (models propose, never authorize; policy-gated execution; evidence timelines). Descriptions are directional; verify details against OpenAI’s official docs and the MasterEngine docs before an architecture decision. This page will be refreshed after the September 29, 2026 DevDay keynote with anything OpenAI confirms.