OpenAI’s Agents API Manages the Harness—You Still Govern the Tools

On September 10, 2026, OpenAI’s launch announcement put the Agents API into public beta for all developers. The service provides a managed version of the Codex harness, while customers choose the model, tools, knowledge, workflows, and execution environment.

The release transfers a defined layer of operational work to OpenAI, not authority over the finished application. OpenAI maintains sessions, context handling, tool coordination, and optional subagent orchestration; application teams still determine what an agent can access, which actions it may take, where its code runs, and when a person must approve the result.

What the managed harness absorbs

The Agents API packages the control loop around repeated model calls into a hosted service. It maintains durable sessions, streams events, accepts additional input while work is running, and allows applications to resume a session instead of reconstructing the agent’s state after each interruption.

Context management also moves into the managed layer. As a session approaches its context limit, the harness can compact earlier work while preserving information needed to continue. Workflows can therefore extend across multiple context windows without requiring the application to implement its own compaction mechanism.

Tool coordination is included, but tool authority is not. Tool search loads definitions when they are relevant, while programmatic tool calling can run operations in parallel, chain them, and filter large results in code before returning a smaller result to the model. Supported interfaces include MCP servers, custom functions, and built-in tools such as web search.

Developers may also enable multi-agent orchestration and impose a concurrency limit. A primary agent can assign independent work to subagents with separate contexts and consolidate their results. OpenAI operates that coordination mechanism, while the application decides whether delegation is enabled and which capabilities are available to the session.

The execution environment remains a deployment choice

The managed harness can connect to an OpenAI-hosted sandbox, infrastructure operated by the customer, or a supported partner environment. This separation lets a team choose where code runs without also operating the agent loop.

In an OpenAI-hosted sandbox, OpenAI provisions the environment used to execute code, work with files, and produce artifacts. Developers configure the files, packages, skills, plugins, and other capabilities placed in that workspace.

Customer infrastructure provides control over matters such as machine images, private-network access, storage, secrets, and specialized compute, but the customer remains responsible for securing and maintaining that environment. With a partner sandbox, OpenAI continues to host the harness while the selected provider supplies the execution environment under its own technical and commercial terms.

Tools, data, and production authority stay with the application

The API can select an available tool, but the application defines the available set and the authority behind each connection. Teams must authenticate MCP servers and custom functions, restrict credential scopes, validate sensitive requests, handle tool failures, and enforce approval requirements outside the model’s instructions.

The same boundary applies to information access. Application owners choose which repositories, databases, telemetry systems, documents, and secrets a session can reach. Those choices form part of the application’s protection against authenticated API data exposure: a valid credential can still grant broader access than a particular agent task requires.

Orply’s incident-investigation walkthrough demonstrates the boundary through a fictional agent supplied with observability tools, repository access, and an evidence-first outage runbook. Its output is a proposed mitigation for an on-call team, not an autonomous production change.

That example is a configured workflow rather than a universal safety guarantee. Runbooks remain application-supplied instructions, and teams must separately enforce environment boundaries, read-only access, argument validation, and human approval for consequential operations. Centralized orchestration cannot turn an overprivileged connector into a least-privileged one.

Billing follows models, tools, and the selected compute

There is no separate Agents API fee during the public beta: customers pay the applicable charges for model tokens and tools. An OpenAI-hosted sandbox can add container usage, while customer-operated or partner environments have their own infrastructure costs.

A technical assessment from S5 Labs confirms the model, tool, and hosted-container billing structure and identifies two current data-control constraints: Agents API data residency is limited to the United States, and Zero Data Retention is not supported. Choosing self-hosted compute does not remove those API-level constraints.

The managed harness may reduce infrastructure that a team would otherwise build, but it does not establish a fixed cost for completing a business task. Total spending depends on model selection, session length, tool activity, context volume, subagent concurrency, and the execution environment. Tool search and programmatic filtering can limit unnecessary material sent into model context, but budgets and usage monitoring remain deployment-specific.

The production boundary becomes a four-part decision

1. Harness: OpenAI maintains sessions, context compaction, tool coordination, and optional subagent orchestration.
2. Compute: the developer selects an OpenAI-hosted sandbox, customer infrastructure, or a partner environment and accepts the operational obligations attached to that choice.
3. Capabilities: the application supplies tools, MCP connections, functions, knowledge sources, credentials, files, packages, and runbooks.
4. Authority: the application enforces which operations are read-only, which require validation or approval, and which may affect production systems, money, or customer data.

The Agents API remains a public beta, and no general-availability date has been specified. Features, limits, pricing details, and data controls may change as the service develops. The current responsibility boundary is nevertheless explicit: OpenAI operates the harness, while the developer remains accountable for the agent’s access, actions, instructions, and execution environment.

Also read:

• API Security’s Hidden Gap: Valid Logins Can Still Expose Business Data
• Five Small-Business Lessons From 2021 That Still Work—After a Cost Reset
• Figma’s Design Agent Is Open Beta—Paid Access Still Has Boundaries