Anthropic Ships Terraform-Style Workflow to Deploy Claude Agents From Code

Anthropic shipped a Terraform-style workflow for its Managed Agents platform. The new ant apply command in the ant CLI lets you describe agents, skills, environments, memory stores, and scheduled deployments as files in your repo, then reconcile them against the Claude API with a single command. Infrastructure-as-code, but for the pieces that make up a Claude agent.

Before this, building a serious multi-agent setup on Anthropic's platform meant clicking around the Console or making raw API calls. That works for one agent. It falls apart when you have a coordinator agent, three sub-agents, a couple of skills, a shared memory store, and a nightly cron deployment that all reference each other.

How It Works

Each resource is a Markdown, YAML, or JSON file. In Markdown, frontmatter holds the configuration and the body fills the text field: an agent's system prompt, an environment's description, or a deployment's first message. Run ant apply agents/summarizer.md and the CLI prints a plan, waits for approval, creates the resource, and writes a claude-lock.json file.

That lockfile records the ID of the resource each file created, along with the organization and workspace. Commit it, and the next run, on your machine or in CI, finds those resources instead of creating duplicates. Two hashes fingerprint what was last sent and what the API returned, so a later run can detect drift from either an edited local file or a change made elsewhere.

Wiring Resources Together by Path

Wherever the API expects another resource's ID, you write the relative path to that resource's file instead. ant apply creates them in dependency order and fills in the real IDs. A coordinator agent lists ./reviewer.md in its roster, a reviewer lists ../skills/pr-summary, and a nightly deployment names its agent, environment, and memory store by path. Point ant apply . at the directory and the whole graph comes up. Agent and skill references are pinned to the version just applied, so editing a reviewer or skill updates everything that references it in the same run.

Skill references can also be GitHub URLs, such as a directory of Anthropic's open-source skills repository. ant apply downloads and uploads that directory, pinned to the resolved commit until you run with --upgrade.

Kind Inference and Directory Conventions

Files don't need to be tagged with their type. ant apply determines each file's kind from the first match of: a top-level type field, the directory it sits in (agents/, environments/, memory_stores/, deployments/), or a filename that starts with the kind such as environment_staging.md. Files that match none, like READMEs or CI configs, are skipped unless named explicitly.

CI and Drift Detection

The recommended CI pattern:

• Run ant apply --dry-run . on pull requests to print the plan for reviewers.
• Run ant apply --yes . on the default branch after merge.
• Commit the updated claude-lock.json at the end of the job, even on partial failure.
• Authenticate with Workload Identity Federation rather than a stored API key.

ant apply refuses credentials that resolve to any organization or workspace other than the one recorded in claude-lock.json, which prevents a misconfigured CI job from spraying resources across environments.

Drift is handled loudly. If a resource was edited, archived, or deleted outside these files, the plan exits with a refusal. Pass --force to overwrite the edit or create a replacement. Deletions are conservative too: removing a file leaves its resource in place with a warning, and --prune removes it, archiving agents or deleting skills.

No Adoption Path for Existing Resources

There is no way to bring in resources you already created. ant apply cannot adopt anything made in the Console or with ant beta:agents create. Only what's in the lockfile is managed, and applying a file that describes an existing agent creates a second one. The escape hatch is the Console's Export as code button, which ships a claude-lock.json alongside the exported files so subsequent runs update the resources you built there.

Why Developers Should Care

Managed Agents were already trending toward multi-file systems: an agent plus its skills, environment, memory, and schedule. Without ant apply, teams end up writing their own thin wrapper around the create endpoints, their own drift detection, and their own ID-mapping layer. That's a lot of glue code that doesn't differentiate anything.

By making the repo the source of truth and treating the API as a reconciliation target, Anthropic pushes agent development toward the same review-and-merge discipline as application code. Diffs go through PRs. Rollbacks are a git revert plus an apply. Staging and production become two lockfiles pointing at two workspaces. For anyone building agents that outlive a prototype, that's the workflow worth having.