Contained agents
Run your own agents sealed off, so you can share them.
Turn on Contained for an agent you created and it works in its own sealed space with only the knowledge you grant. That makes it safe to put on your website for visitors, on a page in your Canvas theme, or in the app for your team.
An admin switches it on in the agent’s Contained settings in Canvas. The first time, they press “Set up on this server”, which needs about 6 GB of free disk space and uses about 4 GB.
A contained agent on the website of a fictional coffee shop, Harbor Coffee.
What contained means
Each conversation runs in its own sealed space.
A contained agent assumes every message could be hostile. Even if someone talks it into something, it can only reach what you granted, spend up to its cap and talk in that one conversation.
What it can do
Three things
Read the knowledge you granted, write its reply, and ask for a person on a website chat. Nothing else is allowed.
What it cannot reach
The rest of your server
Your files, other conversations, memory, credentials, saved logins, the browser and the internet are all out of reach.
Before a reply leaves
A check for secrets
Passwords and keys the platform knows, and common key formats, are removed from every reply before anyone sees it.
Choosing who sees an agent in the app keeps your menus tidy. What keeps the agent safe is the containment itself.
Where it runs
Put a contained agent where people need it.
In the app
For your team
Members who see the agent talk to it like any other agent, and every conversation runs contained.
On a Canvas page
Inside your own interface
Add a chat block to a custom page in your Canvas theme. For now it works on pages people sign in to.
On any website
For your visitors
Turn on “Anyone can talk to it” and add your websites. Visitors are told it is an AI, and a person can join.
What people use them for
Start from a use case.
Customer support
Support on your website
An agent answers visitors from your knowledge, says it is an AI, and a person from your team can join.
See the use case →A business of your own
Build an agent once, rent it out
Build an agent that does one specific job well, then rent it to clients for their website, their Canvas pages or their team.
See the use case →Your team
Internal agents for staff
An HR, IT or policy helpdesk that answers from your documents only, in the app or on a Canvas page.
See the use case →Anything else
Your own agent with a clear job
If an agent you create should answer from a known body of knowledge and nothing more, it can run contained.
How it works
From an agent to a contained agent.
Turn on Contained
In the Contained settings of an agent you created, switch it on. The first time, press “Set up on this server”. Built-in and organization-managed agents keep full power, so make a separate agent for contained use.
Grant what it may read
A knowledge folder, project documents and approved skills. It sees nothing else.
Choose where it runs
In the app, in a chat block on a Canvas page, or on your websites with “Anyone can talk to it” and “On websites”.
Watch and improve
Read its conversations, see which website chats are waiting for a person, and improve what it knows.
Spending you control
You decide how much it can spend.
Every contained agent has four spending limits, checked before any cost: per answer, per person or visitor per day, for the agent per day, and for all contained agents on the server per month. By default they are $0.50, $2, $20 and $200, the same in the app, on Canvas pages and on websites, and you can change them in the agent’s Contained settings. When a limit is reached, the person gets a polite message.
- Contained agents run on a separate Anthropic API key you add for them, never your server’s Claude subscription.
- On websites, visitors are rate limited, and a bot check runs when a chat opens.
On your website
It says it is an AI, and a person can join.
Every website chat starts with “You're chatting with an AI assistant. A person can join if you ask.” The line stays at the top and cannot be dismissed.
- A visitor can ask for a person at any time. The conversation shows up as waiting for a person in your settings, and the agent stays quiet while a person handles it.
- Replies from your team are labelled with the person’s name and “(a person)”.
- Replies are plain text. Links are clickable only to your own websites, and images never load on their own.
- AI answers can be wrong. The agent is told not to invent facts, prices or promises, and you can read every conversation. You are responsible for what it tells your visitors.
- The script tag runs on your page with your page's rights, like any script you add. The plain iframe runs nothing on your page.
What your team sees: the conversation as plain text and a reply box.
Visitor privacy
Visitors stay anonymous.
- No sign-in. Each visitor gets an anonymous id, kept in the chat window.
- The chat itself stores only part of the visitor’s IP address. Like any website, the servers’ access logs record full addresses for a limited time, and the bot check (Cloudflare Turnstile) sees the address too.
- Visitor messages are processed by the AI model provider (Anthropic) to produce answers.
- Conversations are deleted after 90 days by default, and you can change that or delete a visitor’s conversation at any time.
- Activity logs record what happened, never what was said. Spending records identify a visitor only by an anonymous id, and a team member by their account number, never their email.
- You decide what the chat is for, so your privacy notice should cover it and name the AI model provider (Anthropic) and Cloudflare Turnstile, which sees the visitor’s IP address and browser information.
Off switch
Turn it off whenever you need to.
Turn a contained agent off at any moment. New messages are refused straight away, and a reply in progress is stopped, in the app and on your websites.
Each website chat also has its own on/off switch. Turning it off stops that chat straight away: nothing more reaches visitors, and the chat shows “This chat is unavailable right now.”
Not in this first version
What a contained agent does not do yet.
To keep contained agents sealed, this first version leaves out the browser and saved logins, credentials, memory between conversations, schedules, messages to other agents, Slack and email, and models other than Claude. Chat blocks on Canvas pages work on signed-in pages only for now. Each can come later after its own security review.
Run your own agents sealed off, and share them where they help.
$19 for 7 days on a dedicated CRHQ server. Then $299/month, cancel anytime.