diff --git a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
index 6e15118d9..ad2e81506 100644
--- a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
+++ b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
@@ -376,6 +376,7 @@ test('AgentCoreStack synthesizes with empty spec', () => {
     spec: {
       name: 'testproject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
diff --git a/src/assets/cdk/test/cdk.test.ts b/src/assets/cdk/test/cdk.test.ts
index 0e9434dc1..bf79b5378 100644
--- a/src/assets/cdk/test/cdk.test.ts
+++ b/src/assets/cdk/test/cdk.test.ts
@@ -8,6 +8,7 @@ test('AgentCoreStack synthesizes with empty spec', () => {
     spec: {
       name: 'testproject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
diff --git a/src/cli/commands/create/action.ts b/src/cli/commands/create/action.ts
index f947ccbea..3c2f26efa 100644
--- a/src/cli/commands/create/action.ts
+++ b/src/cli/commands/create/action.ts
@@ -28,6 +28,7 @@ function createDefaultProjectSpec(projectName: string): AgentCoreProjectSpec {
   return {
     name: projectName,
     version: 1,
+    managedBy: 'CDK' as const,
     agents: [],
     memories: [],
     credentials: [],
diff --git a/src/cli/commands/logs/__tests__/action.test.ts b/src/cli/commands/logs/__tests__/action.test.ts
index a68dea92e..14a92ba03 100644
--- a/src/cli/commands/logs/__tests__/action.test.ts
+++ b/src/cli/commands/logs/__tests__/action.test.ts
@@ -43,6 +43,7 @@ describe('resolveAgentContext', () => {
     project: {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime' as const,
@@ -96,6 +97,7 @@ describe('resolveAgentContext', () => {
       project: {
         name: 'TestProject',
         version: 1,
+        managedBy: 'CDK' as const,
         agents: [
           {
             type: 'AgentCoreRuntime' as const,
@@ -138,6 +140,7 @@ describe('resolveAgentContext', () => {
       project: {
         name: 'TestProject',
         version: 1,
+        managedBy: 'CDK' as const,
         agents: [
           {
             type: 'AgentCoreRuntime' as const,
@@ -207,6 +210,7 @@ describe('resolveAgentContext', () => {
       project: {
         name: 'TestProject',
         version: 1,
+        managedBy: 'CDK' as const,
         agents: [],
         memories: [],
         credentials: [],
diff --git a/src/cli/commands/remove/command.tsx b/src/cli/commands/remove/command.tsx
index fe508cb86..c09cfab0e 100644
--- a/src/cli/commands/remove/command.tsx
+++ b/src/cli/commands/remove/command.tsx
@@ -26,6 +26,7 @@ async function handleRemoveAll(_options: RemoveAllOptions): Promise<RemoveResult
     await configIO.writeProjectSpec({
       name: projectName,
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
diff --git a/src/cli/commands/status/__tests__/action.test.ts b/src/cli/commands/status/__tests__/action.test.ts
index 34fe57b89..e5f5b58f1 100644
--- a/src/cli/commands/status/__tests__/action.test.ts
+++ b/src/cli/commands/status/__tests__/action.test.ts
@@ -31,6 +31,7 @@ vi.mock('../../../logging', () => {
 const baseProject: AgentCoreProjectSpec = {
   name: 'test-project',
   version: 1,
+  managedBy: 'CDK' as const,
   agents: [],
   memories: [],
   credentials: [],
diff --git a/src/cli/commands/validate/__tests__/action.test.ts b/src/cli/commands/validate/__tests__/action.test.ts
index aa4652ff7..0890f5ec8 100644
--- a/src/cli/commands/validate/__tests__/action.test.ts
+++ b/src/cli/commands/validate/__tests__/action.test.ts
@@ -79,7 +79,7 @@ describe('handleValidate', () => {
 
   it('returns success when all configs are valid', async () => {
     mockFindConfigRoot.mockReturnValue('/project/agentcore');
-    mockReadProjectSpec.mockResolvedValue({ name: 'Test', agents: [] });
+    mockReadProjectSpec.mockResolvedValue({ name: 'Test', version: 1, managedBy: 'CDK' as const, agents: [] });
     mockReadAWSDeploymentTargets.mockResolvedValue([]);
     mockConfigExists.mockReturnValue(false);
 
@@ -100,7 +100,7 @@ describe('handleValidate', () => {
 
   it('returns error when AWS targets fails', async () => {
     mockFindConfigRoot.mockReturnValue('/project/agentcore');
-    mockReadProjectSpec.mockResolvedValue({ name: 'Test', agents: [] });
+    mockReadProjectSpec.mockResolvedValue({ name: 'Test', version: 1, managedBy: 'CDK' as const, agents: [] });
     mockReadAWSDeploymentTargets.mockRejectedValue(new Error('bad targets'));
 
     const result = await handleValidate({});
@@ -111,7 +111,7 @@ describe('handleValidate', () => {
 
   it('validates state file when it exists', async () => {
     mockFindConfigRoot.mockReturnValue('/project/agentcore');
-    mockReadProjectSpec.mockResolvedValue({ name: 'Test', agents: [] });
+    mockReadProjectSpec.mockResolvedValue({ name: 'Test', version: 1, managedBy: 'CDK' as const, agents: [] });
     mockReadAWSDeploymentTargets.mockResolvedValue([]);
     mockConfigExists.mockReturnValue(true);
     mockReadDeployedState.mockResolvedValue({ targets: {} });
@@ -124,7 +124,7 @@ describe('handleValidate', () => {
 
   it('returns error when state file is invalid', async () => {
     mockFindConfigRoot.mockReturnValue('/project/agentcore');
-    mockReadProjectSpec.mockResolvedValue({ name: 'Test', agents: [] });
+    mockReadProjectSpec.mockResolvedValue({ name: 'Test', version: 1, managedBy: 'CDK' as const, agents: [] });
     mockReadAWSDeploymentTargets.mockResolvedValue([]);
     mockConfigExists.mockReturnValue(true);
     mockReadDeployedState.mockRejectedValue(new Error('bad state'));
@@ -137,7 +137,7 @@ describe('handleValidate', () => {
 
   it('uses custom directory when provided', async () => {
     mockFindConfigRoot.mockReturnValue('/custom/agentcore');
-    mockReadProjectSpec.mockResolvedValue({ name: 'Test', agents: [] });
+    mockReadProjectSpec.mockResolvedValue({ name: 'Test', version: 1, managedBy: 'CDK' as const, agents: [] });
     mockReadAWSDeploymentTargets.mockResolvedValue([]);
     mockConfigExists.mockReturnValue(false);
 
diff --git a/src/cli/external-requirements/__tests__/checks-extended.test.ts b/src/cli/external-requirements/__tests__/checks-extended.test.ts
index 63aa3d4d9..a461ff9ca 100644
--- a/src/cli/external-requirements/__tests__/checks-extended.test.ts
+++ b/src/cli/external-requirements/__tests__/checks-extended.test.ts
@@ -36,6 +36,7 @@ describe('requiresUv', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -61,6 +62,7 @@ describe('requiresUv', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -86,6 +88,7 @@ describe('requiresUv', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -103,6 +106,7 @@ describe('requiresContainerRuntime', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -128,6 +132,7 @@ describe('requiresContainerRuntime', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -153,6 +158,7 @@ describe('requiresContainerRuntime', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -168,6 +174,7 @@ describe('requiresContainerRuntime', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -253,6 +260,7 @@ describe('checkDependencyVersions', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -272,6 +280,7 @@ describe('checkDependencyVersions', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -290,6 +299,7 @@ describe('checkDependencyVersions', () => {
     const project: AgentCoreProjectSpec = {
       name: 'Test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
diff --git a/src/cli/operations/agent/generate/__tests__/write-agent-to-project.test.ts b/src/cli/operations/agent/generate/__tests__/write-agent-to-project.test.ts
index 0e863610d..40d13321f 100644
--- a/src/cli/operations/agent/generate/__tests__/write-agent-to-project.test.ts
+++ b/src/cli/operations/agent/generate/__tests__/write-agent-to-project.test.ts
@@ -23,6 +23,7 @@ describe('writeAgentToProject with credentialStrategy', () => {
   const baseProject = {
     name: 'MyProject',
     version: 1,
+    managedBy: 'CDK' as const,
     agents: [],
     memories: [],
     credentials: [],
diff --git a/src/cli/operations/agent/generate/write-agent-to-project.ts b/src/cli/operations/agent/generate/write-agent-to-project.ts
index 0da650def..1b93e09b2 100644
--- a/src/cli/operations/agent/generate/write-agent-to-project.ts
+++ b/src/cli/operations/agent/generate/write-agent-to-project.ts
@@ -64,6 +64,7 @@ export async function writeAgentToProject(config: GenerateConfig, options?: Writ
     const project: AgentCoreProjectSpec = {
       name: agentName,
       version: SCHEMA_VERSION,
+      managedBy: 'CDK' as const,
       agents: [agent],
       memories,
       credentials,
diff --git a/src/cli/operations/dev/__tests__/config.test.ts b/src/cli/operations/dev/__tests__/config.test.ts
index ca54987da..e9eebfa66 100644
--- a/src/cli/operations/dev/__tests__/config.test.ts
+++ b/src/cli/operations/dev/__tests__/config.test.ts
@@ -13,6 +13,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -30,6 +31,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -57,6 +59,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -90,6 +93,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -118,6 +122,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -144,6 +149,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -173,6 +179,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -202,6 +209,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -231,6 +239,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -260,6 +269,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -287,6 +297,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -315,6 +326,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -343,6 +355,7 @@ describe('getDevConfig', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -377,6 +390,7 @@ describe('getAgentPort', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -413,6 +427,7 @@ describe('getAgentPort', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -435,6 +450,7 @@ describe('getDevSupportedAgents', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -451,6 +467,7 @@ describe('getDevSupportedAgents', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -477,6 +494,7 @@ describe('getDevSupportedAgents', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -514,6 +532,7 @@ describe('getDevSupportedAgents', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
@@ -542,6 +561,7 @@ describe('getDevSupportedAgents', () => {
     const project: AgentCoreProjectSpec = {
       name: 'TestProject',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [
         {
           type: 'AgentCoreRuntime',
diff --git a/src/cli/operations/mcp/__tests__/create-mcp-utils.test.ts b/src/cli/operations/mcp/__tests__/create-mcp-utils.test.ts
index c6c32e1e7..c46a53d03 100644
--- a/src/cli/operations/mcp/__tests__/create-mcp-utils.test.ts
+++ b/src/cli/operations/mcp/__tests__/create-mcp-utils.test.ts
@@ -126,6 +126,7 @@ describe('GatewayPrimitive.add (createGateway)', () => {
     mockReadProjectSpec.mockResolvedValue({
       name: 'test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -159,6 +160,7 @@ describe('GatewayPrimitive.add (createGateway)', () => {
     mockReadProjectSpec.mockResolvedValue({
       name: 'test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -182,6 +184,7 @@ describe('GatewayPrimitive.add (createGateway)', () => {
     mockReadProjectSpec.mockResolvedValue({
       name: 'test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
@@ -205,6 +208,7 @@ describe('GatewayPrimitive.add (createGateway)', () => {
     mockReadProjectSpec.mockResolvedValue({
       name: 'test',
       version: 1,
+      managedBy: 'CDK' as const,
       agents: [],
       memories: [],
       credentials: [],
diff --git a/src/cli/operations/memory/__tests__/create-memory.test.ts b/src/cli/operations/memory/__tests__/create-memory.test.ts
index a219c458e..f9e1af72f 100644
--- a/src/cli/operations/memory/__tests__/create-memory.test.ts
+++ b/src/cli/operations/memory/__tests__/create-memory.test.ts
@@ -20,6 +20,7 @@ vi.mock('../../../../lib/index.js', () => ({
 const makeProject = (memoryNames: string[]) => ({
   name: 'TestProject',
   version: 1,
+  managedBy: 'CDK' as const,
   agents: [],
   memories: memoryNames.map(name => ({
     name,
diff --git a/src/cli/operations/remove/__tests__/remove-agent-ops.test.ts b/src/cli/operations/remove/__tests__/remove-agent-ops.test.ts
index d592594d2..a07123102 100644
--- a/src/cli/operations/remove/__tests__/remove-agent-ops.test.ts
+++ b/src/cli/operations/remove/__tests__/remove-agent-ops.test.ts
@@ -20,6 +20,7 @@ vi.mock('../../../../lib/index.js', () => ({
 const makeProject = (agentNames: string[]) => ({
   name: 'TestProject',
   version: 1,
+  managedBy: 'CDK' as const,
   agents: agentNames.map(name => ({ name, type: 'AgentCoreRuntime' })),
   memories: [],
   credentials: [],
diff --git a/src/cli/operations/remove/__tests__/remove-identity-ops.test.ts b/src/cli/operations/remove/__tests__/remove-identity-ops.test.ts
index a1ba32e87..dd0f78989 100644
--- a/src/cli/operations/remove/__tests__/remove-identity-ops.test.ts
+++ b/src/cli/operations/remove/__tests__/remove-identity-ops.test.ts
@@ -24,6 +24,7 @@ const makeProject = (
 ) => ({
   name: 'TestProject',
   version: 1,
+  managedBy: 'CDK' as const,
   agents: [],
   memories: [],
   credentials: credNames.map(name => ({ name, type: 'ApiKeyCredentialProvider' })),
diff --git a/src/cli/operations/remove/__tests__/remove-memory-ops.test.ts b/src/cli/operations/remove/__tests__/remove-memory-ops.test.ts
index 21eb2e8ad..0ecd27e64 100644
--- a/src/cli/operations/remove/__tests__/remove-memory-ops.test.ts
+++ b/src/cli/operations/remove/__tests__/remove-memory-ops.test.ts
@@ -20,6 +20,7 @@ vi.mock('../../../../lib/index.js', () => ({
 const makeProject = (memoryNames: string[]) => ({
   name: 'TestProject',
   version: 1,
+  managedBy: 'CDK' as const,
   agents: [],
   memories: memoryNames.map(name => ({ name, type: 'AgentCoreMemory', eventExpiryDuration: 30, strategies: [] })),
   credentials: [],
diff --git a/src/cli/primitives/__tests__/EvaluatorPrimitive.test.ts b/src/cli/primitives/__tests__/EvaluatorPrimitive.test.ts
index 6cca73057..4a95d0de0 100644
--- a/src/cli/primitives/__tests__/EvaluatorPrimitive.test.ts
+++ b/src/cli/primitives/__tests__/EvaluatorPrimitive.test.ts
@@ -33,6 +33,7 @@ function makeProject(
   return {
     name: 'TestProject',
     version: 1,
+    managedBy: 'CDK' as const,
     agents: [],
     memories: [],
     credentials: [],
diff --git a/src/cli/primitives/__tests__/GatewayPrimitive.test.ts b/src/cli/primitives/__tests__/GatewayPrimitive.test.ts
index 0a612a33d..47223bad9 100644
--- a/src/cli/primitives/__tests__/GatewayPrimitive.test.ts
+++ b/src/cli/primitives/__tests__/GatewayPrimitive.test.ts
@@ -5,6 +5,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 const defaultProject: AgentCoreProjectSpec = {
   name: 'test',
   version: 1,
+  managedBy: 'CDK' as const,
   agents: [],
   memories: [],
   credentials: [],
diff --git a/src/cli/primitives/__tests__/OnlineEvalConfigPrimitive.test.ts b/src/cli/primitives/__tests__/OnlineEvalConfigPrimitive.test.ts
index badcce2a1..0cc4679d5 100644
--- a/src/cli/primitives/__tests__/OnlineEvalConfigPrimitive.test.ts
+++ b/src/cli/primitives/__tests__/OnlineEvalConfigPrimitive.test.ts
@@ -19,6 +19,7 @@ function makeProject(
   return {
     name: 'TestProject',
     version: 1,
+    managedBy: 'CDK' as const,
     agents: [],
     memories: [],
     credentials: [],
diff --git a/src/cli/primitives/__tests__/auth-utils.test.ts b/src/cli/primitives/__tests__/auth-utils.test.ts
index 633579fb9..1b3530875 100644
--- a/src/cli/primitives/__tests__/auth-utils.test.ts
+++ b/src/cli/primitives/__tests__/auth-utils.test.ts
@@ -85,6 +85,7 @@ describe('createManagedOAuthCredential', () => {
   const baseProject: AgentCoreProjectSpec = {
     name: 'test',
     version: 1,
+    managedBy: 'CDK' as const,
     agents: [],
     memories: [],
     credentials: [],
diff --git a/src/cli/tui/screens/create/useCreateFlow.ts b/src/cli/tui/screens/create/useCreateFlow.ts
index 666b9ef93..6f3086753 100644
--- a/src/cli/tui/screens/create/useCreateFlow.ts
+++ b/src/cli/tui/screens/create/useCreateFlow.ts
@@ -73,6 +73,7 @@ function createDefaultProjectSpec(projectName: string): AgentCoreProjectSpec {
   return {
     name: projectName,
     version: 1,
+    managedBy: 'CDK' as const,
     tags: {
       'agentcore:created-by': 'agentcore-cli',
       'agentcore:project-name': projectName,
diff --git a/src/cli/tui/screens/remove/useRemoveFlow.ts b/src/cli/tui/screens/remove/useRemoveFlow.ts
index 0051f9f81..8594a5b77 100644
--- a/src/cli/tui/screens/remove/useRemoveFlow.ts
+++ b/src/cli/tui/screens/remove/useRemoveFlow.ts
@@ -31,6 +31,7 @@ function createDefaultProjectSpec(projectName: string): AgentCoreProjectSpec {
   return {
     name: projectName,
     version: 1,
+    managedBy: 'CDK' as const,
     agents: [],
     memories: [],
     credentials: [],
diff --git a/src/lib/schemas/io/__tests__/config-io.test.ts b/src/lib/schemas/io/__tests__/config-io.test.ts
index 1da80af77..5746babf5 100644
--- a/src/lib/schemas/io/__tests__/config-io.test.ts
+++ b/src/lib/schemas/io/__tests__/config-io.test.ts
@@ -179,6 +179,7 @@ describe('ConfigIO', () => {
       const validSpec = {
         name: 'TestProject',
         version: 1,
+        managedBy: 'CDK' as const,
         agents: [
           {
             type: 'AgentCoreRuntime',
diff --git a/src/schema/llm-compacted/agentcore.ts b/src/schema/llm-compacted/agentcore.ts
index d897d506f..36a57b766 100644
--- a/src/schema/llm-compacted/agentcore.ts
+++ b/src/schema/llm-compacted/agentcore.ts
@@ -13,6 +13,7 @@
 interface AgentCoreProjectSpec {
   name: string; // @regex ^[A-Za-z][A-Za-z0-9]{0,22}$ @max 23 - project name
   version: number; // Schema version (integer)
+  managedBy: 'CDK'; // Enum — infrastructure manager. Default: "CDK"
   tags?: Record<string, string>;
   agents: AgentEnvSpec[]; // Unique by name
   memories: Memory[]; // Unique by name
diff --git a/src/schema/schemas/__tests__/agentcore-project.test.ts b/src/schema/schemas/__tests__/agentcore-project.test.ts
index 64aa5ea9e..2482fbae9 100644
--- a/src/schema/schemas/__tests__/agentcore-project.test.ts
+++ b/src/schema/schemas/__tests__/agentcore-project.test.ts
@@ -445,6 +445,24 @@ describe('AgentCoreProjectSpecSchema', () => {
     expect(result.success).toBe(true);
   });
 
+  it('defaults managedBy to CDK when omitted', () => {
+    const result = AgentCoreProjectSpecSchema.safeParse(minimalProject);
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.managedBy).toBe('CDK');
+    }
+  });
+
+  it('accepts explicit managedBy: CDK', () => {
+    const result = AgentCoreProjectSpecSchema.safeParse({ ...minimalProject, managedBy: 'CDK' });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects invalid managedBy value', () => {
+    const result = AgentCoreProjectSpecSchema.safeParse({ ...minimalProject, managedBy: 'Terraform' });
+    expect(result.success).toBe(false);
+  });
+
   it('rejects non-integer version', () => {
     const result = AgentCoreProjectSpecSchema.safeParse({
       name: 'Test',
diff --git a/src/schema/schemas/agentcore-project.ts b/src/schema/schemas/agentcore-project.ts
index d19dfaec7..c1b934b79 100644
--- a/src/schema/schemas/agentcore-project.ts
+++ b/src/schema/schemas/agentcore-project.ts
@@ -41,6 +41,13 @@ export { PolicyEngineNameSchema, PolicyNameSchema, PolicySchema, ValidationModeS
 export { TagsSchema };
 export type { Tags } from './primitives/tags';
 
+// ============================================================================
+// ManagedBy Schema
+// ============================================================================
+
+export const ManagedBySchema = z.enum(['CDK']).default('CDK');
+export type ManagedBy = z.infer<typeof ManagedBySchema>;
+
 // Re-export MCP types (now part of unified schema)
 export type { AgentCoreGateway, AgentCoreGatewayTarget, AgentCoreMcpRuntimeTool } from './mcp';
 export { AgentCoreGatewaySchema, AgentCoreGatewayTargetSchema, AgentCoreMcpRuntimeToolSchema } from './mcp';
@@ -170,6 +177,7 @@ export const AgentCoreProjectSpecSchema = z
   .object({
     name: ProjectNameSchema,
     version: z.number().int().min(1),
+    managedBy: ManagedBySchema,
     tags: TagsSchema.optional(),
 
     agents: z
diff --git a/src/tui-harness/helpers.ts b/src/tui-harness/helpers.ts
index 5e02fa762..b5cfc94f7 100644
--- a/src/tui-harness/helpers.ts
+++ b/src/tui-harness/helpers.ts
@@ -90,6 +90,7 @@ export async function createMinimalProjectDir(
   const config: Record<string, unknown> = {
     name: projectName,
     version: 1,
+    managedBy: 'CDK',
     agents: [] as unknown[],
     memories: [],
     credentials: [],