Hosted Agents
Hand Dobby a container image and Dobby runs it for you as a managed Cloud Run job — building, preflighting, deploying, and monitoring the agent so every run lands in the compliance dashboard by construction.
Access is gated
Managed Agents is currently internal + design-partner only and requires the hosted_agents entitlement. A non-allowlisted tenant gets 403 ENTITLEMENT_DISABLED on every call (being an owner/super-admin does not bypass it), and regulated orgs are additionally blocked from production deploy/invoke/schedule (403 REGULATED_PRODUCTION_BLOCKED). Ask a Dobby admin to enable it before relying on this path.
First: give the agent an LLM (BYOK)
Hosted runs are bring-your-own-key: connect a provider under Settings → Connections → AI Agents and the gateway injects that provider's key + model into each run. With no provider connected, a customer run has no LLM and returns 503 — there is no silent customer-facing default. Managed LLM credits are not generally available yet. Connect a provider before your first run.
The lifecycle
1 · Package
Build a linux/amd64 image on the Dobby base image — the dobby-collector is baked in, so runs are monitored by construction.
2 · Preflight
The server preflight checks the image manifest (size, arch, entrypoint) + contract rules. A CRITICAL finding blocks the deploy (422 PREFLIGHT_CRITICAL).
3 · Deploy
Dobby deploys the image as a Cloud Run Job (not a server — it runs to completion and exits 0). It injects DOBBY_CONNECTOR_ID + DOBBY_BASE_URL and mounts the bearer as a secret.
4 · Invoke
POST …/hosted-agents/{agent_id}/invoke → 202 { execution_id: he_… }. A cron schedule can fire it too. Poll …/executions/{id} until terminal.
Where results appear
The baked-in collector streams telemetry into the shared workload_runs surface, where the compliance scan + verdict attach — the same dashboards a monitored (BYOA) agent feeds. Hosted agents list at /dashboard/hosted-agents. Caps enforced today: max 10 hosted agents and 5 concurrent runs (429 QUOTA_EXCEEDED). Usage is computed for transparency (billing_status: not_invoiced).