A Model Alone Is Not an Agent

Anthropic’s S-1 doubles as a catalog of orchestrator tooling — the harness, the primitives, and the division of labor, itemized under securities liability.

The most useful part of Anthropic’s S-1 is not the financials. It is the platform section, which itemizes the tooling of the orchestrator job in the plain language of a product spec: what a harness is, which primitives exist, and exactly who owns which decisions. I have not seen the stack written down this completely anywhere, including in my own manuscript.

The sentence that anchors it: “A model alone is not an agent.” Running one reliably in production is hard, the filing says, because agents must survive crashes and interruptions, act on systems with scoped and auditable credentials, and scale across variable workloads. So “autonomous operation requires a harness, which provides the secure environment, credentials, memory, and orchestration loop a model needs to plan, call tools, verify its work, and complete a task safely on its own.” That is the infrastructure layer of orchestration, defined between bullet points about prompt caching and batch processing.

The filing then splits the market in two. The Agent SDK “makes the same production-grade harness that powers Claude Code available to all developers, to run on their own compute,” with built-in context management, session handling, multi-agent coordination, and prompt optimization. Claude Managed Agents is the other path: Anthropic operates the harness for you. The division of labor is one sentence: “We host the sandboxes, store the credentials, maintain the memory, and run the agent loop; customers define their agent’s tasks, tools, and guardrails.” Read it twice. The vendor owns the runtime. The customer owns the intent, the tools, and the limits. When a new model ships, you do not rebuild the agent loop — the filing points out you do not need to. You keep owning the three decisions that matter.

Above the models sit the composition primitives: the Agent SDK, Managed Agents, agent skills, multi-agent orchestration, and the Model Context Protocol for “universal connectivity to enterprise data and tools.” Then the claim that tells you where the craft went: “The same primitives that power a coding agent also power a research agent, a financial analyst agent, or a compliance-review agent. While these agents have different connectors and agent skills, they have the same SDK, protocol, and orchestration framework.” The loop is a product now. What differs between an agent that commits code and one that reviews contracts is the connectors and the skills — which is precisely where the orchestrator lives.

The filing gets specific about both. Agent Skills are “a modular framework that lets organizations encode repeatable tasks, workflows, and domain expertise into reusable packages, or skills, that Claude loads on demand” — institutional knowledge, turned into agent capabilities. MCP, introduced in November 2024 and donated to the Linux Foundation’s Agentic AI Foundation in December 2025, is the connector layer, and the platform’s native connector handles connection management, tool discovery, and error handling automatically. Even reasoning is a knob: developers set an effort level per request to “balance response quality against cost and latency.”

The applications ship in order of distance from the terminal. Claude Code for developers, who now “direct and review its work rather than write code line by line.” Claude Cowork extends “the same agentic architecture” to knowledge workers — it translates intent into completed work, reading files and executing multi-step workflows on a desktop “while the underlying code is abstracted away” — and its adoption outpaced Claude Code’s at the equivalent point after launch. Claude Tag sits inside Slack as an ambient teammate you delegate to in plain language, with channel-scoped memory.

Then one paragraph of honesty about what is still missing: “connectors that do not yet exist, governance frameworks that are not yet written, and orchestration logic that needs to be built from scratch” — and the filing says “Our platform seeks to close these gaps, and we believe the breadth and speed with which we have done so is a primary reason customers build on Claude.” The vendor closes the gaps it can productize. The rest stays with the customer — which tasks to delegate, which tools to grant, which guardrails to write. The Risk Factors, pages later, name the sharpest of those remaining jobs: “The pace and volume of autonomous execution, particularly in enterprise deployments, may also exceed the capacity of human reviewers to meaningfully understand and evaluate whether each action is appropriate” — the same review-layer limit I described two weeks ago, now disclosed under securities liability.

That is the division of labor in one filing: Anthropic ships the harness, the primitives, and the loop. The orchestrator supplies the intent, the tools, the guardrails, and the judgment about what gets reviewed. A model alone is not an agent. An agent alone is not an organization. The job in between them now has a product catalog — and it is filed in public.