The interesting part of LangChain’s new hosted agent runtime is not that an agent can remember. It is that memory, schedules, tools, sandboxes, traces, and model credentials now meet inside one production service.
LangChain updated Managed Deep Agents to public beta on August 7. The service runs Deep Agents inside LangSmith with durable threads, streaming, checkpointing, human-in-the-loop controls, managed tools, sandboxes, observability, and an API. Teams can build locally, deploy with the mda command-line tool, and call the agent through a hosted endpoint.
That bundle removes a large amount of agent plumbing. It also concentrates operational decisions that prototypes often postpone: who can call the agent, what every caller can see, where memory lives, which secrets reach deployment, what a schedule may do unattended, and how a human recovers a bad run.
What moved from private to public beta
LangChain originally introduced the managed runtime as a private beta. Its launch page now carries an August 7 update saying Managed Deep Agents is in public beta. The official quickstart still requires a LangSmith organization with public-beta access, a LangSmith API key, Python with uv, and a model-provider API key. The documented cloud region is the United States.
Runtime
Durable execution
Threads, checkpoints, streaming, and human review support work that lasts longer than one request.
Environment
Tools and sandboxes
Agents can use managed integrations, custom tools, file systems, and isolated execution environments.
Operations
Traces and schedules
LangSmith records model calls, tools, and memory activity; deployments can also run on a cron schedule.
The deployment flow synchronizes an agent’s instructions to Context Hub and stores the selected model-provider key with the deployment. The hosted API is then reached through a /v1/deepagents endpoint. That is a meaningful shift from a notebook agent: instructions and credentials become deployment assets with lifecycle, access, and audit requirements.
Shared memory is the sharpest default to understand
LangChain’s tutorial makes durable memory optional. Once enabled, however, the memory is shared across the deployment and visible to all callers. The documentation explicitly warns not to store personal data or secrets there.
Deployment boundary
Shared means shared across callers
Do not treat deployment memory like a user’s private notebook. If several customers, teams, or tenants call one deployment, a memory write can become context for someone else unless the application adds the right isolation.
This does not mean the service leaks data by design. It means the documented memory scope is broader than many developers will assume. A production application needs an explicit tenant model: separate deployments, separate memory namespaces where supported, an application-level filter, or no durable memory for sensitive workflows.
The same question appears in browser agents. Our analysis of agents operating inside signed-in sessions found that convenience inherits the permissions and data already present in the environment. Hosted memory inherits the callers and retention policy of the deployment around it.
Tracing gives you an audit trail, not a policy
LangSmith traces can show inputs, model calls, tool calls, memory reads and writes, and final responses. That is valuable. It lets a team reconstruct how an agent reached an answer and which tool or memory entry influenced it.
A trace does not decide whether the input should have been stored, whether a tool needed approval, or how long a record may be retained. Observability records behavior; governance defines acceptable behavior. Production teams need both.
| Layer | Managed capability | Your remaining decision |
|---|---|---|
| Execution | Threads, checkpoints, streaming, retries, human-in-loop support. | Which actions pause, who approves, and what happens after timeout or partial failure. |
| Memory | Durable, deployment-level memory when enabled. | Tenant isolation, permitted data, retention, deletion, and conflict handling. |
| Tools | Managed integrations, custom tools, and sandboxes. | Scopes, credentials, allowlists, write limits, and recovery from harmful actions. |
| Observability | Traces of prompts, calls, tools, memory, and outputs. | Redaction, access control, retention, alerting, and incident review. |
| Schedules | Cron-based unattended runs. | Budget ceilings, concurrency, freshness, idempotency, and a kill switch. |
Schedules turn a demo into an operator
The tutorial shows a research agent that can run a daily digest on a cron schedule. That is useful because the runtime can continue without a person opening the app. It is also the point where a surprising tool call, duplicate job, stale source, or cost spike can repeat automatically.
Before enabling a schedule, make the task idempotent, cap runtime and model spend, decide whether overlapping runs are allowed, and create an alert for repeated failure. Give the schedule a service identity rather than borrowing a developer’s broad credentials. The lesson matches our overnight-agent handoff checklist: unattended duration increases the value of checkpoints, limits, and morning-after review.
The public beta still has boundaries
“Public beta” does not mean every LangSmith user has a production service-level promise. The official quickstart still describes beta access requirements and a US cloud region. LangChain’s launch material lists the managed features, but the pages checked for this article did not present a simple public pricing table for the hosted runtime.
Teams should ask for the current pricing model, quotas, regional roadmap, retention terms, support path, and beta change policy before committing a customer workflow. Do not infer cost from ordinary model tokens alone. Hosted execution, sandboxes, storage, traces, and schedules can add different meters.
A production-readiness pass before deployment
Eight controls to define
- Caller identity: authenticate every application and preserve the caller in traces.
- Memory scope: document who shares memory and prohibit secrets or personal data by default.
- Credential ownership: use narrowly scoped service keys and a rotation procedure.
- Tool permissions: separate read, write, external communication, and destructive actions.
- Sandbox policy: define network, filesystem, package, and execution limits.
- Human checkpoints: pause before expensive, external, irreversible, or high-impact actions.
- Trace hygiene: redact sensitive fields and restrict who can inspect full runs.
- Schedule guardrails: set spend, duration, concurrency, failure alerts, and a kill switch.
Security teams can reuse the questions in our AI-agent security review. The important shift is to review the whole runtime—identity, tools, memory, schedules, and recovery—not only the model prompt.
My verdict: public beta is the start of the architecture review
Managed Deep Agents can save a team from building its own durable execution layer, trace pipeline, deployment service, and sandbox integration. That is substantial product value. The public beta makes the stack easier to test with real workflows.
Use that convenience to accelerate the prototype, not skip the boundary design. Shared memory needs a data policy. Schedules need budgets and a kill switch. Tools need service identities and narrow scopes. Traces need redaction and access controls. A managed runtime can operate the machinery; your application still decides what the machinery is allowed to do.
Read the source record
- Read LangChain’s updated Managed Deep Agents launch page.
- Follow the official public-beta quickstart.
- Inspect the tutorial for memory, traces, deployment, and schedules.
- Review LangSmith’s current terms and product documentation before moving regulated or sensitive workloads into the beta.
Which memory should an agent be forced to forget before the next caller arrives?
Checked August 8, 2026. Managed Deep Agents is a public beta with documented US-region and access requirements. Feature availability, pricing, quotas, and beta terms can change; confirm them in the current LangChain and LangSmith documentation.
