On this page · 10 sections
Summary. On 20 August 2026 Anthropic added allowed_domains and blocked_domains to the web_search and web_fetch entries of the Claude Managed Agents toolset. The documentation attaches four constraints the release note does not: each list holds at most 64 entries, a web_fetch entry cannot include a path, max_uses and citations are unavailable on Managed Agents, and, most consequentially, the organization-level domain restriction an administrator sets in the Claude Console applies to Messages API requests only. Managed Agents sessions use nothing but the per-tool lists on the agent. A blocked web_fetch returns an error the agent can see. A blocked web_search result is silently omitted. Web search costs $10 per 1,000 searches plus token costs; web fetch adds no charge beyond tokens.
If a security team believes one Console setting governs every Claude surface, that belief is wrong for the surface that runs unattended. The only spend backstop is the session budget Anthropic shipped on 7 August 2026, and it stops a session rather than capping it exactly.
What shipped
The Claude Platform release notes for 20 August 2026 record the change: you can now restrict which sites a Claude Managed Agents agent's web_search and web_fetch tools reach, by setting allowed_domains or blocked_domains on the tool's entry in the agent_toolset_20260401 configs array. The same entry accepts max_content_tokens for web_fetch and user_location for web_search.
The Managed Agents tools page describes the runtime behaviour. allowed_domains means the tool can reach only those hosts; blocked_domains means it can never reach them. Each tool carries its own list, so search and fetch can be restricted differently. A listed domain covers that host and all of its subdomains.
Then the asymmetry. A web_fetch call for a URL the lists do not permit returns an error result to the agent, with is_error: true on the agent.tool_result event and an error code of url_not_allowed. A web_search call does not error. It omits the results the lists do not permit. The agent receives a shorter result set and no signal that anything was filtered.
That distinction matters for anyone writing agent evaluations. A fetch denial is observable and testable. A search omission looks identical to a query that found nothing.
The Console setting does not reach agent sessions
The web search tool documentation states it directly: organization-level settings in the Claude Console apply to Messages API requests only, and Claude Managed Agents sessions use only the per-tool allowed_domains and blocked_domains lists on the agent toolset.
Set against how tightly the Console list binds Messages API traffic, that is a wide gap. On the Messages API, per the server tools documentation, a request-level allowed_domains must be a subset of the organization-level allowed list, entries outside it cause a validation error, and a request-level allowed list that includes a domain the organization blocks is rejected with a 400 error naming the conflicting entries.
None of that enforcement exists for a Managed Agents session. The agent's own configs array is the whole policy.
| Control | Messages API | Claude Managed Agents |
|---|---|---|
| Console organization-level domain restriction | Applies, and request lists must be a subset of it | Does not apply |
| Per-request or per-tool allowed_domains and blocked_domains | Available on the tool object | Available on the toolset configs entry |
| Maximum entries per list | Not stated | 64 |
| Path entries in the list | Supported for web search, ignored by web fetch | Not permitted for web fetch |
| max_uses, citations, cache_control | Available | Not available |
| Conflicting request and organization lists | 400 error naming the entries | No organization list to conflict with |
Rules that trip people up
The matching rules are the same fields with different behaviour per tool, and they are easy to get wrong in a policy review.
Domains carry no scheme. Write example.com, not https://example.com. Invalid formats are rejected at request time with a 400 invalid_request_error.
Subdomains are automatically included. example.com covers docs.example.com. Listing a specific subdomain narrows rather than widens: docs.example.com returns only that subdomain, not example.com or api.example.com.
Paths work for one tool and not the other. Subpaths are supported for web search and match anything after the path, so example.com/blog matches example.com/blog/post-1. Web fetch matches on the domain only, and an entry that includes a path never matches a web fetch URL. On Managed Agents the rule is stricter still: domains listed for web_fetch cannot include a path at all.
Wildcards are not allowed in the domain, only in the path after it.
And the two lists are mutually exclusive. You can use allowed_domains or blocked_domains, not both in the same request.
There is one more guardrail that predates this change and still applies. The web fetch tool can only fetch URLs that previously appeared in the conversation context; a URL that did not returns url_not_in_prior_context. The url_not_allowed code covers domain filtering, private addresses and robots.txt restrictions together, so a denial does not tell you which of the three fired.
The cost side
Two different pricing models sit behind these two tools, which is worth knowing before you widen an allowlist.
| Tool | Charge | Token treatment |
|---|---|---|
| web_search | $10 per 1,000 searches | Search-generated content counted as input tokens in the same turn and in later turns |
| web_fetch | No additional charge | Fetched content billed as standard input tokens |
| max_content_tokens on web_fetch | No charge | Truncates text content, limit is approximate |
| Binary content such as PDFs | No charge | max_content_tokens does not apply to it |
| Managed Agents session budget | No charge | Hard cap priced at public list rates |
Two of those rows are traps. max_content_tokens is documented as approximate, so actual input tokens can vary by a small amount around your ceiling. More importantly, the limit applies to text content and not to binary content such as PDFs, so an allowlisted domain that serves large PDFs can push an agent's token consumption past the figure you set.
The backstop is the session budget Anthropic shipped on 7 August 2026: a hard spend ceiling priced at public list rates that pauses the session with a budget_reached stop reason. The budgets documentation notes that the request in flight when the cap is crossed still finishes, so the final list cost can land a fraction past the budget. A budget is a stop, not a precise limit. Our earlier analysis of Claude session budget list cost covers that behaviour in detail.
What to do this week
Inventory which Claude surfaces your organisation actually runs. If the answer includes Managed Agents, the Console privacy settings page is not your control plane for those sessions, and any compliance statement that says otherwise needs rewriting.
Move the domain policy into the agent definition and into version control. Since the list is capped at 64 entries and allowed_domains and blocked_domains are mutually exclusive, an allowlist strategy forces a real decision about which 64 hosts an autonomous agent may reach. That is a healthier conversation than an open blocklist, and it is the same reasoning behind our AI agent governance layers approach.
Add an evaluation for silent search filtering. Because web_search omits rather than errors, an agent whose allowlist is misconfigured will look like an agent that cannot find anything. Test with a query whose only good answer sits on an allowlisted host, and a second whose only answer sits off it, and assert on the difference.
Treat the allowlist as a prompt-injection control, not only a data-egress control. Every domain you allow is a domain that can put text into the agent's context. The narrower list is the smaller attack surface, which is the same argument in our guide to AI agent prompt injection guardrails.
India-specific considerations
For Indian teams operating under DPDP (Digital Personal Data Protection Act 2023), the egress question is usually framed as where personal data can go. A blocked_domains list is the weaker answer, because it permits everything not named. An allowed_domains list of at most 64 hosts is the defensible one, and it is now the only mechanism available for Managed Agents sessions, since the Console-level restriction does not apply to them.
Budget the search line separately. At $10 per 1,000 searches, an agent fleet that runs a few hundred thousand searches a month is a five-figure dollar line before token costs, which changes the build-versus-buy maths covered in our agent web search API cost comparison.
What is still unknown
Anthropic has not said whether the Console organization-level domain restriction will be extended to Managed Agents sessions, and has not published a per-Region or per-workspace variant of the per-tool lists. The 64-entry cap is documented without a stated path to raise it. Until that changes, treat agent-level configuration as the only enforcement point for Managed Agents web access.
FAQ
How eCorpIT can help
eCorpIT is a CMMI Level 5 and ISO 27001:2022 certified engineering organisation in Gurugram, and our senior-led AI teams build the enforcement layer that agent platforms leave to you. For Claude Managed Agents that means holding the 64-entry allowlist in version control next to the agent definition, writing evaluations that catch silent search filtering, and pairing the domain policy with a session budget so a misconfiguration is bounded in dollars. Our AI agent security guardrails service covers that work end to end, and you can book an agent governance review to start with your current toolset configuration.
Further reading on this pillar: enterprise AI agents in production.
References
Last updated: 22 August 2026.
