Anthropic has published a framework for building AI agents that can keep working in the background across sessions. Its five proposed building blocks cover incoming events, scheduled tasks, persistent memory, permissions and outgoing messages: the unglamorous plumbing behind an agent that does more than wait for another prompt.
Anthropic Watch analysis
What happened
The framework appears in Anthropic’s guide to building always-on agents. The company identifies an event inbox for incoming triggers, durable timers for scheduled work, persistent memory for continuity between sessions, a permission system involving credentials and automated modes, and an outbox for communications.
Together, Anthropic says, these components are intended to support stateful agents that can act proactively in the background. The guide describes an architecture, not evidence that every agent built this way will be reliable or safe.
Why it matters
An agent that keeps operating between conversations needs a way to notice events, remember what has happened and decide what it is allowed to do. Anthropic’s list makes those requirements tangible. It also puts permissions and outbound communication alongside memory and scheduling, rather than treating autonomy as a clever prompt with a calendar attached.
For developers, the framework is a useful checklist for designing persistent agents. For everyone else, it shows where the consequential choices sit: what can trigger action, what the system retains, which credentials it can use and what it may send out.
Our read
This is a clear architectural map, not a magic recipe. The useful emphasis is that always-on behaviour depends on several interacting systems, and that permission controls belong in the foundations. If you are building an agent, examine those boundaries before letting it run unattended; “it remembered the task” is not the same as “it should be allowed to finish it”.
What to watch
- How developers handle expired, repeated or conflicting events in the inbox.
- What persistent memory stores and how people can inspect or clear it.
- How credentials and automated modes limit what an agent can do.
- What safeguards apply before an agent sends an external message.
Discussion spark: Which should be the first hard limit on an always-on agent: what it can remember, what it can access, or what it can send?
Sources and evidence
- Building always-on agents | Claude by Anthropic (13 November 2026, 00:00 UTC)
Anthropic Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by Anthropic.