Managed Internal Agents
Managed internal agents are IntuitivePM-hosted agent runtimes. They are useful when your company wants agent-assisted work without operating its own runtime host, package, service account, container, or developer workstation bridge.
External agents remain available for companies that need a runtime inside their own environment, such as a code-writing tool on a controlled VM, a Docker worker, n8n, or an internal automation system.
Managed internal agents are an Enterprise capability. They appear only when your workspace has been enabled for the feature and your administrator has permission to configure agents.
Managed internal agents are designed for controlled workflow assistance: analysis, summaries, review support, progress reporting, and approved outputs. They are not a general-purpose automation host and do not receive raw provider keys, connector credentials, or unrestricted network access.
Internal vs External Agents
| Area | Managed internal agent | External agent runtime |
|---|---|---|
| Runtime location | Operated by IntuitivePM | Operated by your company |
| Setup effort | Lower; no runtime host to manage | Higher; you install and operate the runtime |
| Best for | Standard task analysis, summaries, review assistance, controlled workflow steps | Code execution, private network access, custom tools, company-specific automation |
| Credentials | Stay inside IntuitivePM-managed services | Stored in your approved runtime environment |
| Network access | Restricted to approved IntuitivePM services and connectors | Controlled by your network and runtime policy |
| Updates | Managed by IntuitivePM | Managed by your company |
| Troubleshooting | Agent Registry runtime details and IntuitivePM support | Agent Registry plus your runtime host logs |
Use a managed internal agent when the work can be done through IntuitivePM context, approved AI providers, connected sources, Work Files, and workflow tools.
Use an external runtime when the agent must run in your environment, access private developer tools, operate against a local checkout, or use a custom execution engine.
What Managed Internal Agents Can Do
The first supported pattern is controlled, lease-scoped agent work:
- A workflow or task assigns work to an eligible managed internal agent.
- IntuitivePM checks the agent is active, allowed for the company, and has available capacity.
- The managed runtime receives only the assigned work context.
- The runtime reports progress, submits output, and waits for review according to the workflow.
- IntuitivePM records comments, progress events, completion evidence, review decisions, and billing attribution.
Managed internal agents do not receive provider API keys, connector credentials, or broad workspace credentials. AI calls and connector reads go through IntuitivePM so billing, access control, audit, and tenant isolation remain server-side.
The initial supported execution mode is intentionally conservative. A managed internal agent can complete safe read-only workflow work and submit evidence for review. Write-capable or tool-heavy automation requires explicit product support, company approval, and the workflow’s review controls.
Create A Managed Internal Agent
When the feature is enabled for your company:
- Open System -> Integrations -> Agent Registry.
- Click Create Agent.
- Choose Internal Agent.
- Enter a clear name and purpose.
- Assign an owner and any required team or project visibility.
- Configure the capability profile and default role expectations.
- Add default Knowledge Sources and Outputs if the agent needs them.
- Save the agent.
The agent appears in Agent Registry with managed runtime status. It can be selected for workflows only after IntuitivePM has provisioned the runtime and the registry shows it as active.
Begin with one internal agent, one simple workflow, and one low-risk task. Expand to more agents after you have reviewed the first progress events, completion evidence, and review decisions.
Control Who Can See And Use An Agent
Each managed internal agent has two access settings:
| Setting | Meaning |
|---|---|
| Can see | Who can view the agent in catalogs, selectors, and admin surfaces. |
| Can use | Who can assign the agent to workflow or task work. |
New agents start with conservative access. Grant broader access only after the owner has confirmed the intended team, project, or board scope.
Access can be limited to:
- the owner only
- selected users
- selected teams
- selected projects
- selected boards
- the whole company
Seeing an agent does not automatically mean a user can use it. If a workflow or task selector does not show an agent, or says that no invokable agents are available, check the agent’s Can use policy and runtime status first.
Administrators can use the Agent Registry access audit panel to review who can see or use a selected agent, and to look up which agents are available for a user, team, project, or board.
Lifecycle States
| State | Meaning | What to do |
|---|---|---|
| Not enabled | Your company is not enabled for managed internal agents. | Ask your IntuitivePM administrator or support contact. |
| Draft or inactive | The agent exists but is not eligible for workflow dispatch. | Finish configuration and activate it when ready. |
| Provisioning | IntuitivePM is preparing the managed runtime. | Wait briefly, then check Runtime details if it does not become active. |
| Active | The runtime is online and eligible for work when capacity is available. | Assign it to a workflow or task. |
| Retry or failed | Provisioning or runtime health needs attention. | Open Runtime details and follow the recommended checks. |
| Offline | The agent record exists, but the runtime is not currently connected. | Use Runtime details; an administrator may request reconcile or restart when available. |
Assign To Workflows
Managed internal agents can be selected in workflow nodes when they are active and dispatch-ready. If an agent is not selectable, IntuitivePM shows the reason, such as provisioning, inactive status, failed runtime health, missing permissions, or capacity limits.
For workflows that include review loops, a managed internal agent can be used as the worker or reviewer when the workflow policy allows it. Review feedback and source content are treated as untrusted input. They can provide facts or requested changes, but they cannot override platform policy, permissions, billing limits, or review gates.
Troubleshooting
Open System -> Integrations -> Agent Registry, select the agent, and review Runtime details.
Check:
- Runtime status and last heartbeat.
- Provisioning status and reason.
- Whether the agent is active and visible to the right teams or projects.
- Whether the workflow node requires a capability the agent does not have.
- Whether the company or agent has reached a configured capacity or usage limit.
- The latest action status if an administrator requested reconcile or restart.
Company administrators can also open AI Agents -> Advanced setup -> AI Providers and review the Runtime Capacity tab. That tab shows the current internal-agent limit, runtime online count, work-slot usage, company active-work cap, and per-agent active-work cap.
If the status is stale or failed, use the recommended action shown in Runtime details. Do not create duplicate agents to work around a failed runtime; that makes audit and billing harder to understand.
Security Model
Managed internal agents follow these boundaries:
- Work is company-scoped.
- Work actions require assignment-specific lease authorization.
- The runtime cannot choose another company, agent, runtime, workflow, node, or assignment by sending those IDs in a request body.
- Source content, reviewer feedback, and user-authored text are treated as untrusted data.
- Provider keys and connector tokens stay in IntuitivePM-controlled services.
- Output writes follow the workflow’s review and approval rules.
These boundaries are why managed internal agents are safer for standard workflow assistance than a broad, customer-operated automation host.