OpenAI Launches Agents API: Managed Codex Harness, Durable Sessions, Hosted Sandboxes, and Public-Beta Limits

OpenAI launched the Agents API in public beta on September 10, 2026, positioning it as a managed API interface to the Codex harness and the infrastructure needed to run long-lived agentic work. In OpenAI’s launch materials and developer documentation, the practical change is that developers can specify the task, model, tools, and execution environment while OpenAI operates the session orchestration layer, the harness, context management, and recovery machinery. This is not a general-availability release, and teams should treat the beta label as operationally meaningful: OpenAI says the API will evolve quickly before GA, so production plans should include version tracking, regression tests, rollout controls, and a rollback path.

The article explains OpenAI’s August 2026 open-sourcing of the Codex agent harness, including its architecture, SDKs, app-server, and developer use cases for production software agents. The complete OpenAI Open-Sources the Codex Agent Harness: Architecture, SDKs, App-Server, and What Developers Can Build article provides the destination-specific detail for this section’s Open Source Codex Harness decision because this is the exact background post for the Codex harness referenced by the marker and directly supports discussion of how OpenAI’s managed Agents API relates to the open-source harness.

OpenAI describes the API as powered by the open-source Codex harness, but the public-beta service is not just a code library wrapped in an endpoint. The API introduces durable sessions, automatic context compaction as sessions approach context limits, progress streaming, webhooks, tool search, programmatic tool calling, Model Context Protocol support, built-in tools such as web search, hosted and non-hosted environments, and multi-agent execution. Each of those capabilities reduces integration burden only if the application treats the API as a stateful distributed system rather than a one-shot chat completion call.

What changed in the September 10 public beta

Why managed Codex harness access changes the agent build decision

The most important product shift is not that agents can call tools; many teams already built tool-calling workflows with prior APIs. The change is that OpenAI is now offering a managed operating layer for longer-running, file-aware, tool-using agent work. A session can persist configuration, conversation, and saved work across turns, and developers can continue or steer the session rather than rebuilding the entire state envelope for every request. That changes architecture for repository maintenance, data-transformation jobs, document production, research support, and internal developer tooling where work often spans multiple steps and produces intermediate files.

For developers and platform teams, managed harness access reduces the amount of custom infrastructure needed to get from a prompt to a working task loop. OpenAI manages session orchestration, context compaction, and recovery, while the application decides what tools exist, which credentials they can use, which environment executes code, what budget limits apply, and which actions require human approval. A useful decision rule is simple: use the managed layer for agent state and orchestration when it reduces undifferentiated platform work, but keep security, authorization, approval, observability, and compliance enforcement in your own application boundary.

The article covers Codex Chronicle, OpenAI’s screen-context memory system designed to preserve context across long-running development sessions. The complete Codex Chronicle: How OpenAI’s Screen-Context Memory System Transforms Long-Running Development Sessions article provides the destination-specific detail for this section’s Codex Long Running Sessions decision because it is the strongest match for durable or long-running Codex sessions because it focuses specifically on maintaining development context over extended agent work.

Operational warning: a managed harness does not convert an agent result into a verified business outcome. OpenAI’s documentation distinguishes session and turn state from full workflow success; a completed turn does not prove that every tool succeeded, and an idle session or closed stream is not a sufficient success condition.

The four core concepts: Agent, Environment, Session, and Events/Items

An Agent is the configured worker that receives the task and instructions and can use the selected model and tools. In application terms, the agent is not your entire product; it is the managed execution actor inside a workflow you design. A practical agent specification should include the task objective, allowed tools, constraints, output format, escalation rules, and acceptance criteria. For example, an internal code-maintenance agent should be told which repository area it may inspect, whether it may edit files, what tests it should run if available, and what evidence it must return before a human reviewer approves a merge.

An Environment is where the agent’s code and command-line work run. OpenAI documents three broad choices: an OpenAI-hosted sandbox, developer-owned infrastructure, and supported sandbox partners. The OpenAI-hosted option is a Linux workspace with Python, Node.js, and command-line tools, using /workspace as the working directory. It can be configured with pinned Python, system, and npm packages; ordered setup commands; files supplied by Files API ID or inline base64; string environment variables; skills; plugins; capability directories; and reusable environment templates. Environment choice should be treated as a governance decision because it controls filesystem behavior, network reachability, artifact handling, compute billing, and where secrets should or should not be placed.

A Session preserves the agent configuration, conversation, and saved work across turns. A typical lifecycle is to create the session, submit input, follow progress through streams or webhooks, continue or steer the work, retrieve saved state when necessary, save required artifacts, and delete the session when finished. Session creation is not the same as environment readiness in the hosted sandbox: the create-session response means setup has started, and applications must wait until the environment reaches the documented connected state before assuming the sandbox can execute work. This matters for reliable user experience because a UI that immediately displays “ready” after session creation may mask setup failures or delayed package installation.

Events and Items are the observability and recovery surface for asynchronous agent work. Events report progress, state changes, tool activity, required actions, turn outcomes, and subagent coordination. Items are saved records that can be retrieved to rebuild state after a stream interruption or to inspect prior work. Streams do not replay missed events, so a resilient client should open a new stream, buffer new events, retrieve the session and saved items while connected, rebuild local state keyed by item ID, apply buffered updates, and resume live handling. List endpoints are paginated, so recovery code should not assume that a single page contains every saved item.

What OpenAI manages, and what applications still own

OpenAI’s managed responsibilities include the Codex harness service, session orchestration, context compaction, recovery support, and the mechanics of the OpenAI-hosted sandbox when that environment is selected. The hosted environment can run code, work with files, and publish artifacts from /workspace/outputs after a turn completes. OpenAI’s launch also names ecosystem integrations including Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel, which signals that environment strategy is expected to span both first-party and partner infrastructure. The documentation boundary remains important: supported environment options do not remove the need for application-level policy.

Application teams still own the permissions model. The developer decides which tools the agent can call, which MCP servers are reachable, which credentials are exposed to tool execution, which network destinations are allowed, and which actions are prohibited or gated. The application API key should stay outside the agent sandbox, and raw HTTP requests require the documented beta header, OpenAI-Beta: agents=v1. The beta SDK namespace is beta.agents, and Agents API requests require an application API key with the documented scopes api.agents.read, api.agents.write, and api.responses.write. Those permissions should be granted as narrowly as the application architecture allows.

Application teams also own budget controls. OpenAI says the public beta has no separate Agents API fee, but that statement is not a free-execution promise. Teams still pay for model tokens and tools, and hosted sandboxes are billed at container rates separately from model usage. Third-party environments or connected services may create additional charges under their own commercial terms. A practical budget design should track session count, turn count, model usage, tool usage, hosted-container runtime, artifact volume, retries, and user-initiated follow-up work before exposing agent workflows broadly inside an organization.

Security teams should treat the hosted sandbox as a capable execution environment, not as a place to embed privileged application secrets casually. OpenAI-hosted network access may be enabled, disabled, or restricted. In restricted mode, the allowlist accepts 1 to 100 exact hostnames; wildcards, protocols, paths, and ports are not accepted, and subdomains or redirect destinations require separate entries. A template’s inherited network policy cannot be broadened by an override. Hosted stdio MCP servers currently require enabled network access, so teams that need strict egress controls should evaluate whether a given MCP design is compatible with their network policy.

Product owners and compliance leaders still own review and acceptance. A root turn can complete while an individual tool call produced a partial result, failed in a recoverable way, or generated an output that needs domain review. The application must recognize turn.failed, turn.cancelled, and session.failed, and it must handle agent.session.requires_action by inspecting required actions and supplying function results or connecting the environment as documented. For high-impact actions such as code deployment, financial analysis, legal review, healthcare operations, or irreversible data changes, human approval gates should be explicit product features rather than informal expectations.

Public beta boundaries developers should not skip

The data boundary is one of the clearest beta constraints. OpenAI’s Agents API documentation states that the current API supports data residency only in the United States and does not support Zero Data Retention. Choosing a self-hosted sandbox does not make Agents API usage ZDR-eligible. This is a material procurement and architecture point for enterprises with regional residency commitments, regulated-data obligations, or contractual ZDR requirements. Teams should not infer that retention behavior from another OpenAI endpoint or a different compaction feature transfers to Agents API sessions.

The lifecycle boundary is equally important. Closing an event stream does not cancel the running task, and deleting a busy session can return a conflict that should be retried with a bounded delay. Connected hosted sandboxes receive keep-alives; if activity and keep-alives stop for one hour, the sandbox can be deleted, and that timeout is not configurable. Files persist across turns while the sandbox exists, while files under /workspace/outputs become immutable published artifacts after a turn completes and remain downloadable after sandbox expiry. Applications that need durable records should save required artifacts before deleting the session and should not confuse live workspace files with published artifacts.

The multi-agent boundary deserves early design attention. OpenAI documents multi-agent execution for independent tasks that can be delegated, while short tasks and tightly dependent steps should remain with the main agent. The coordinator and subagents share one environment filesystem; creating a subagent does not create a separate sandbox. Subagents inherit configured MCP tools, credentials and allowed tools, web-search settings, files, and command-line access, but they do not support function tools. If multiple agents edit the same files, the product workflow must coordinate ownership, sequencing, and merge review rather than assuming the harness will resolve conflicts like a human engineering lead.

The right way to read the launch is as a significant new managed layer, not a replacement for application engineering. OpenAI is taking on more of the agent runtime: harness operation, sessions, compaction, recovery, and hosted execution. Developers, founders, administrators, research leaders, security teams, and financial professionals still need to decide which tasks are appropriate, which data may enter the workflow, which tools are authorized, how costs are capped, how failures are recovered, how artifacts are retained, and where human judgment is mandatory. That division of responsibility is the core architectural fact behind the September 10 Agents API public beta.

Capabilities developers can actually design around

OpenAI’s launch material positions the Agents API as a managed way to run Codex-style agent workflows, but the most important practical detail is narrower: developers now get an API surface for sessions, environments, tools, events, and delegated work without operating the full harness themselves. That is a launch claim about managed infrastructure, not a guarantee that an arbitrary workflow will complete correctly, stay within budget, choose the right tool, or satisfy a regulated review process. Teams should treat the API as an orchestration layer that can preserve work and coordinate tools, while their application remains responsible for authorization, validation, observability, approval gates, cost controls, and cleanup.

The beta’s capability set is easiest to understand as a stack. Durable sessions preserve agent state across turns. Automatic context management helps the managed harness continue working as context limits approach. Tool search and tool calling let the agent discover and use configured capabilities. MCP, custom functions, and built-in tools such as web search extend what the agent can reach. Environments determine where code runs and files live. Multi-agent execution lets a coordinator delegate independent work to subagents. Each layer expands what developers can build, but each layer also creates a separate failure mode that applications must detect rather than assuming the platform has converted intent into verified completion.

Durable sessions: persistent work cycles, not an automatic success record

In the Agents API model, a session preserves configuration, conversation, and saved work across turns. That makes it different from a single request/response interaction: a user can start a long-running investigation, steer it after partial progress, retrieve saved state, and continue from the same session instead of reconstructing the entire context from scratch. OpenAI’s documentation describes sessions as part of the managed infrastructure, meaning the application does not have to implement every piece of Codex-harness state handling itself.

Durability should not be confused with correctness. A session can preserve failed attempts, partial outputs, tool errors, and intermediate reasoning artifacts that still need inspection. A completed turn is not documented as proof that every tool call succeeded, and `agent.session.idle` is not a success condition by itself. Production clients should persist the session ID alongside their own conversation or job record, then inspect turn outcome events, saved items, and artifacts before deciding whether the work is accepted, retried, escalated, or cancelled.

// Example state rule for an application event handler.
// This is a proposed workflow pattern, not a complete SDK example.

if (event.type === "agent.session.turn.completed") {
  markRootTurnFinished();
  fetchSavedItemsAndValidateExpectedOutputs();
}

if (event.type === "agent.session.turn.failed" ||
    event.type === "agent.session.turn.cancelled" ||
    event.type === "agent.session.failed") {
  stopAutomaticPromotionToUser();
  fetchSavedItemsBeforeRetry();
  routeToRetryPolicyOrHumanReview();
}

if (event.type === "agent.session.idle") {
  // Idle means no active work is running; it does not prove success.
  waitForRootTurnOutcomeOrInspectCurrentState();
}

The operational value of durable sessions is strongest when the application has a job ledger. For example, a developer tool could store the session ID, requested repository task, allowed tools, artifact expectations, human reviewer, budget ceiling, and final acceptance checklist in its own database. If the stream disconnects, the application should not blindly restart the same work; it should reconnect, retrieve saved session items, reconcile local state by item ID, and only then decide whether to steer, retry, or cancel.

Automatic context management: useful compaction, not a substitute for task design

OpenAI says the Agents API includes automatic context compaction as sessions approach context limits. In practice, this means the managed harness can reduce the context burden of a long session so the agent can continue operating without the developer manually summarizing every prior turn. That is a significant ergonomics improvement for multi-step code, research, and analysis workflows where the relevant state can outgrow a single prompt.

The boundary matters. Automatic context management does not mean every detail will remain equally available in the model’s active working context, and it does not remove the need to save canonical outputs in durable places. If a workflow depends on exact test results, generated files, source diffs, regulatory assumptions, or financial calculations, the application should require explicit artifacts or saved items rather than relying on the agent’s future recall of earlier conversation. Teams should design acceptance criteria around retrievable evidence, not around the presence of a long chat history.

Administrators should also avoid conflating Agents API context management with retention guarantees from other API surfaces. The Agents API currently supports data residency only in the United States and does not support Zero Data Retention, according to the documentation summarized for this launch. Selecting a self-hosted sandbox does not make the Agents API ZDR-eligible. That distinction is especially important for enterprises that previously evaluated compaction behavior in other OpenAI APIs under different storage settings.

Tool search, programmatic tool calling, MCP, and web search

OpenAI lists tool search, programmatic tool calling, MCP, custom functions, and built-in tools such as web search among the Agents API capabilities. The practical implication is that an agent can operate over a configured tool universe instead of being limited to natural-language output. A coding agent might inspect files, run commands, call a function exposed by the application, consult an MCP-connected service, or use web search if the developer has configured the workflow to allow that capability.

Tool search should be treated as assistance in selecting from available capabilities, not as a security boundary. The application still has to decide which tools are registered, which credentials are available, what arguments are acceptable, what network destinations may be reached, what output should be trusted, and which actions require human confirmation. A tool that can read a ticket is materially different from a tool that can deploy code, transfer funds, change a customer record, or publish external content. The managed harness can orchestrate tool use, but it cannot infer an organization’s approval policy from the existence of a tool.

Programmatic tool calling is the place where product design and platform security meet. If the application exposes custom functions, it should validate every argument server-side, check the current user’s authorization, enforce idempotency where retries are possible, log the request with enough context for audit, and return structured errors that the agent can handle. Do not embed an application API key inside the agent sandbox, and do not let a sandboxed process become the trust anchor for privileged operations. The application server should remain the enforcement point for identity, entitlement, rate limits, and irreversible actions.

The article explains how to use MCP Tool Search in OpenAI Codex, focusing on dynamic tool discovery for AI agents at runtime. The complete How to Use MCP Tool Search in OpenAI Codex: Setting Up Dynamic Tool Discovery for AI Agents article provides the destination-specific detail for this section’s MCP Tool Governance decision because mCP tool discovery is directly relevant to governing which tools an agent can find and use, making it the closest MCP-specific support article for this marker.

Web search is a built-in tool named in the launch, and it can be valuable for current public information, documentation lookup, or broad research support. It should not be treated as a verified source of truth by default. Applications in security, finance, healthcare, legal, and enterprise administration should require citation review, source reconciliation, and domain-specific validation before promoting web-derived content into decisions, customer communications, filings, or operational changes. The tool can help gather information; the product still needs a verification path.

Environment choices: hosted, self-managed, or partner sandboxes

The launch describes three environment paths: an OpenAI-hosted sandbox, a developer’s own infrastructure, and supported sandbox partners. This choice is a core architecture decision because it determines where code runs, how dependencies are installed, how files are accessed, how network policy is enforced, and how operational responsibility is divided. The Agents API manages session orchestration, but the environment still shapes security posture, latency assumptions, billing exposure, and integration complexity.

The OpenAI-hosted environment is documented as a Linux workspace with Python, Node.js, and command-line tools, using `/workspace` as the working directory. It can be configured with pinned Python, system, and npm packages; ordered setup commands; files supplied through the Files API or inline base64; string environment variables; skills; plugins; capability directories; and reusable environment templates. This makes the hosted sandbox useful for code execution, data transformation, artifact generation, and reproducible setup, provided the team treats setup as an asynchronous phase rather than instant readiness.

A create-session response means setup has started, not that the environment is connected and ready for work. Applications should observe environment state and wait for `connected` before assuming commands can execute. If the environment fails, the error should be surfaced in the job record and routed to a retry or setup-fix path. This distinction prevents a common beta integration mistake: submitting a complex task immediately after session creation and then misdiagnosing a setup failure as model behavior.

Network access in hosted sandboxes can be enabled, disabled, or restricted. Restricted mode accepts only exact hostnames, with documented constraints such as no wildcards, protocols, paths, or ports; subdomains and redirect destinations may require separate entries. A template’s inherited network policy cannot be broadened by an override. Hosted stdio MCP servers currently require enabled network access, which means teams using MCP need to evaluate whether the required connectivity is compatible with their security model before selecting a hosted configuration.

Choosing a developer-operated environment can be appropriate when an organization needs direct control over execution infrastructure, internal network adjacency, custom observability, or existing compute governance. That choice does not transfer all Agents API data controls into the developer’s environment, and it does not change the documented lack of ZDR support for Agents API sessions. Partner sandboxes may reduce infrastructure work or fit specific deployment models, but teams should evaluate their contracts, logging, data handling, and billing separately rather than assuming OpenAI’s public-beta statement covers every partner-side obligation.

Hosted files and artifacts: live workspace state versus published outputs

Files in the hosted sandbox have two different operational meanings. Files inside the live workspace can persist across turns while the sandbox exists, making them useful for iterative code work, generated intermediate data, and repeated test runs. Files placed under `/workspace/outputs` are published as immutable artifacts after a turn completes and remain downloadable after sandbox expiry. That artifact boundary is important: it gives applications a stable handoff point for deliverables, but it does not mean every temporary file or every live workspace change has been captured.

Teams should explicitly instruct agents where to save deliverables and should validate that expected artifacts exist before marking a job complete. For example, a data-analysis workflow should require the final report, source notebook or script, machine-readable results, and any charts to be written under `/workspace/outputs` if those files must be downloaded after the turn. If multiple outputs are expected and the API downloads one artifact per request, the workflow can zip related outputs inside the workspace before publishing, subject to documented artifact and total-output limits.

Artifact retention also affects cleanup. Published artifacts survive environment expiration, but the application should download required artifacts before deleting the session if those outputs are needed for the customer record, audit package, or downstream pipeline. Deleting an artifact does not delete the live environment file, and deleting a session is a separate lifecycle decision. A safe cleanup routine should distinguish live workspace files, immutable published artifacts, saved session items, and the application’s own stored copies.

1. Before the turn: define the expected output filenames, formats, and acceptance checks in the task contract.
2. During execution: stream events for progress, but do not treat stream closure as completion or cancellation.
3. After root turn completion: retrieve saved items and published artifacts, then verify file presence, size, format, and content-specific acceptance criteria.
4. Before deletion: copy required artifacts into the application’s governed storage and record their provenance.
5. On cleanup: delete sessions and published artifacts according to the organization’s retention policy, while handling busy-session conflicts with bounded retry.

Subagents and shared filesystems: concurrency with coordination costs

Multi-agent execution is one of the more consequential beta capabilities because it lets a main agent coordinate independent subagents. OpenAI’s documentation frames this mode for tasks that can be delegated independently. That qualification matters. If work is short, sequential, or tightly dependent, keeping it with the main agent is usually simpler and safer than splitting it across concurrent subagents that must coordinate state.

Each subagent has its own context while the main agent coordinates the work, but subagents share one environment filesystem with the coordinator. Creating a subagent does not create a separate sandbox. This design can be efficient for parallel code review, separate research branches, or independent test investigations, but it creates collision risk when multiple agents edit the same files. Applications should require file ownership conventions, branch-like directory separation, lock files, or coordinator-mediated merge steps when concurrent agents can write to shared paths.

Subagents inherit configured MCP tools, credentials and allowed tools, web-search settings, files, and command-line access. They do not support function tools, according to the multi-agent documentation. That limitation should influence decomposition: if a delegated task requires a custom function call, the coordinator may need to perform that action itself or route the work through a design that does not depend on subagent-side function tools. Delegation is most effective when subagents can complete bounded investigative or implementation tasks using the inherited environment and permitted tools.

The event stream reports subagent creation and coordination calls, but completion of a create or wait coordination item does not prove that the subagent finished successfully. Inter-agent stream content may also be incomplete, so applications should inspect saved items and turns when reconstructing prior work. If command attribution matters for audit or debugging, the command item’s turn and `subagent_id` can be used to recover which agent executed a command. This is particularly relevant when a shared filesystem change breaks a build and the platform team needs to identify the responsible work branch.

Pricing and beta expectations attached to these capabilities

OpenAI says the public beta has no separate Agents API fee, and developers pay for model tokens and tools. That should be read narrowly. Hosted sandboxes are billed at container rates separately from model usage, and third-party or partner environments may have their own commercial terms. Web search, tools, MCP-connected services, storage, compute, retries, and human review can all contribute to total cost even when there is no additional line item named “Agents API.”

The beta label should shape production planning. OpenAI says the beta will evolve quickly before general availability, so teams should isolate Agents API integration code, monitor SDK and documentation changes, version task contracts, and run regression tests on representative workflows before expanding usage. A responsible rollout treats durable sessions, hosted sandboxes, subagents, and tool orchestration as powerful primitives under evaluation, not as a blanket reliability guarantee for every long-running autonomous workflow.

Limits and economics: how to budget and gate a public-beta agent platform

OpenAI’s launch language creates two simultaneous facts that buyers and builders need to hold together: the Agents API is available in public beta for all developers, and it is not yet a generally available operating layer with frozen behavior, mature procurement assumptions, or enterprise residency parity. The beta exposes managed Codex-harness orchestration, durable sessions, recovery, automatic context management, tools, MCP connections, hosted sandboxes, and multi-agent execution, but OpenAI also says the beta will evolve quickly before general availability. That means the right adoption question is not “can we call the API?” but “which workflows can tolerate beta interface movement, explicit operational supervision, and United States-only data residency?”

This Codex pricing guide explains rate cards, credits, and cost-optimization controls for coding-agent workloads, providing a practical baseline for separating Agents API orchestration from the model, tool, and infrastructure charges that still accrue underneath it. The complete Complete Guide to OpenAI Codex Pricing in 2026: Rate Cards, Credits, and Cost Optimization article provides the destination-specific detail for this section’s OpenAI API Pricing Guide decision because the target is directly about Codex pricing and cost control, making it more precise than a GPT-5.6 tier comparison.

Operational rule: budget the Agents API as a managed execution workflow, not as a single model call. A run may consume model tokens across multiple turns, keep a sandbox alive while setup or commands execute, publish artifacts, call tools, and require recovery or follow-up turns after a partial failure.

Public-beta maturity matrix for production intake

A public beta can be appropriate for internal developer tools, controlled research automation, migration assistants, or backlog triage systems where failure is recoverable and reviewers already inspect outputs. It is a weaker fit for regulated, irreversible, or customer-facing workflows unless the application wraps the agent with permission checks, observability, data classification, human approval, and rollback paths. The maturity assessment should be performed per workflow, not per company, because a software team may safely beta-test dependency-upgrade drafts while the same organization should block the same agent from deploying changes to production without human gates.

Customer-reported examples in launch material should be read as evidence of possible usage patterns, not as benchmarks a new implementation can bank in a financial model. An agent workflow’s cost and reliability depend on task scope, model choice, tool availability, sandbox setup time, repository size, context history, network constraints, retry policy, and how often a human steers the session. A procurement memo should therefore separate vendor-published or customer-reported outcomes from internal measurements collected on representative tasks.

Cost components teams should model before a pilot

The Agents API changes the cost unit from “one prompt, one response” to “a managed session that may run multiple turns over durable state.” A session can include an initial setup, agent reasoning, tool search, command execution, file creation, artifact publication, follow-up instructions, and recovery after a disconnected stream. Each of those phases can change the token and container profile, especially when the agent reads large files, summarizes state, invokes subagents, or performs iterative code edits.

A useful pilot estimate is a formula, not a guessed flat fee: total workflow cost equals model-token cost plus tool cost plus hosted-container or external-environment cost plus retry and review overhead. The calculation should be run against real task samples, including success cases, failed turns, cancelled turns, disconnected streams, and artifact-heavy runs. If a team measures only the happy path, it will under-budget exactly the cases that operational teams spend the most time handling.

Proposed pilot cost worksheet

For each representative workflow:
1. Record model, task type, environment type, and enabled tools.
2. Run enough examples to include simple, complex, failed, and steered sessions.
3. Capture token usage, tool usage, hosted-container time or external environment cost, and number of turns.
4. Count human review minutes and remediation minutes.
5. Calculate:
   session_cost =
     model_tokens
     + billable_tools
     + hosted_container_or_external_environment
     + retry_overhead
     + review_overhead
6. Set per-workflow budgets and stop conditions before broad rollout.

Hosted sandbox setup is not instant readiness

The OpenAI-hosted environment is documented as a Linux workspace with Python, Node.js, command-line tools, and `/workspace` as the working directory. It can be configured with pinned Python, system, and npm packages; ordered setup commands; files supplied by Files API ID or inline base64; string environment variables; skills; plugins; capability directories; and reusable environment templates. Those configuration options make the hosted sandbox practical for code and file workflows, but they also introduce setup variance that must be reflected in readiness checks and timeouts.

A create-session response means setup has started, not that the environment is ready for commands. Applications should wait until the environment reaches the documented connected state and treat a failed environment state as a setup error requiring inspection rather than as an agent reasoning failure. This distinction matters for cost and reliability because package installation, network access, missing files, or setup-command failures can consume time and block useful work before the agent has completed the substantive task.

Reusable environment templates reduce configuration repetition, but they should not be treated as preserved running workspaces. A template captures configuration patterns; each session has a separate workspace, and files persist across turns only while that sandbox exists. For expensive setup sequences, platform teams should measure setup duration, failure frequency, package-cache assumptions, and network dependencies before they promise interactive response times to end users.

Residency, ZDR, and deletion boundaries

The current Agents API data boundary is unusually important for regulated and enterprise teams: the API supports data residency only in the United States and does not support Zero Data Retention. OpenAI’s documentation also states that selecting a self-hosted sandbox does not make the Agents API ZDR-eligible. That means a company cannot satisfy a non-US residency requirement or ZDR-only policy merely by running code execution in its own environment while still using the managed Agents API session layer.

This boundary should be handled as a product eligibility filter before engineering begins. If a workflow includes data that must remain in a non-US region, data governed by a contractual ZDR requirement, or material that internal policy forbids from durable agent sessions, the correct decision is to exclude that workflow from the Agents API pilot under the current documentation. Redaction can help with some use cases, but redaction must be verified against the actual task: an agent cannot debug a proprietary failure if the logs needed to diagnose it have been removed beyond usefulness.

Session deletion is still required operational hygiene. Developers can delete sessions and published artifacts when no longer needed, but deletion is not a substitute for a correct up-front data eligibility decision. Artifacts under `/workspace/outputs` in the hosted environment are published as immutable downloadable artifacts after a turn completes and remain downloadable after sandbox expiry; teams should download required artifacts before deleting the session and should remember that deleting a published artifact does not delete a live environment file while the environment still exists.

Deletion also has runtime edge cases. Closing an event stream does not cancel the task, and deleting a busy session can return a conflict response that should be retried with bounded delay rather than with an unbounded loop. A safe cleanup worker should check whether the session has active work, issue explicit cancellation when appropriate, retrieve required saved items and artifacts, attempt deletion, and cap retries so a broken cleanup path does not become an uncontrolled background cost source.

Network policies and MCP can change both risk and spend

The hosted sandbox network setting can be enabled, disabled, or restricted. Restricted mode allows only 1 to 100 exact hostnames; it does not accept wildcards, protocols, paths, or ports, and subdomains or redirect destinations require separate entries. This exact-hostname rule is a security control and a reliability constraint: a package installer, API client, or MCP server that follows a redirect to an unlisted host may fail even if the initial hostname appears to be allowed.

Teams should treat network access as a scoped dependency list, not an afterthought. For each hostname, record the business purpose, the tool or setup step that needs it, the data expected to leave the sandbox, and the owner who approves the egress. A restricted allowlist that cannot support a hosted stdio MCP server may require an enabled network policy for that server, because OpenAI’s documentation states hosted stdio MCP servers currently require enabled network access; that exception should trigger additional review rather than a blanket permission change.

Responsibilities the managed API does not remove

The managed Codex harness removes a large amount of orchestration work, but it does not remove application accountability. Developers still own user authentication, authorization, tool permissioning, budget enforcement, logging, review queues, incident response, idempotency, retry policy, and the product experience around uncertainty. An agent that can call a tool should still be constrained by the same business rules that would apply to a human user or backend service performing that action.

Turn status must be interpreted carefully. A completed root turn is not proof that every tool succeeded, `agent.session.idle` is not a success signal, and a closed stream is not a cancellation or completion guarantee. Applications must inspect failed and cancelled turns, required actions, saved items, artifacts, and tool results before deciding whether to retry, continue, escalate, or mark the workflow complete. Blind retry after a stream interruption can duplicate work, overwrite files, or obscure the original failure state.

Subagents add another responsibility layer. OpenAI documents multi-agent mode for independent tasks that can be delegated, while short tasks and dependent steps should remain with the main agent. The coordinator and subagents share one environment filesystem, so file edits require coordination; creating a subagent does not create an isolated sandbox. Cost models should also account for concurrency because multiple subagents can expand token usage and command execution while still depending on a single shared workspace.

The practical governance stance is to approve the Agents API first for workflows where the organization can bound data, cost, tools, and consequences. A strong first pilot might generate a migration plan, propose a pull request, summarize repository structure, or produce a report artifact for review. A weak first pilot would grant broad network access, connect privileged tools, process residency-restricted data, and allow automatic external action without a human approval gate. The public beta is most valuable when teams use it to learn the new managed-agent operating model while preserving the controls that production systems already require.

Adoption playbook for buyers, builders, and governance teams

The practical adoption question is not whether the Agents API can run longer-lived Codex-style work; OpenAI’s launch and documentation say it can provide managed session orchestration, hosted or external environments, automatic context compaction, tool connections, and multi-agent execution in public beta. The harder decision is whether a specific organization can define bounded tasks, authorize tools safely, observe asynchronous work, handle incomplete tool results, and justify token, tool, and container costs before expanding usage.

For buyers, the first gate should be workload fit rather than platform enthusiasm. A suitable early workload has a clear input contract, a verifiable output artifact, limited blast radius, known data classification, bounded tool permissions, and a human reviewer who can reject or amend the result. A poor first workload requires irreversible external actions, broad production credentials, ambiguous success criteria, regulated judgment without review, or data residency and Zero Data Retention requirements that the current Agents API does not meet.

For developers, the first gate should be lifecycle discipline. The documentation describes sessions, turns, events, items, environments, and artifacts as separate operational objects, so implementation should not collapse them into a single “agent completed” flag. A production-grade client needs to store session IDs, follow event streams, recover saved state after disconnection, handle required actions, download artifacts before cleanup, and distinguish a root turn outcome from individual tool outcomes.

The article explains Codex approval policies for enterprise environments, including auditable controls for human-in-the-loop approvals, autonomy limits, privacy, safety, and cost controls. The complete The Complete Guide to Codex Approval Policies — Controlling AI Autonomy in Enterprise Environments article provides the destination-specific detail for this section’s Human Approval Gates decision because it is the most semantically appropriate match for human approval gates because it focuses on Codex-specific approval policies and controlling agent autonomy.

Buyer adoption checklist

Developer implementation checklist

• Create least-privilege application access. OpenAI’s quickstart states that Agents API requests require an application API key with api.agents.read, api.agents.write, and api.responses.write. Keep that key in the application server or secure backend, not inside the agent sandbox or user-controlled files.
• Use the beta contract explicitly. Raw HTTP requests require the OpenAI-Beta: agents=v1 header, while OpenAI’s beta SDK namespace is beta.agents. Treat that as an integration boundary that may require active maintenance during the public beta.
• Wait for environment readiness. A create-session response means setup has started, not that the hosted environment is usable. The hosted environment must reach connected, while failed includes an environment error that should be surfaced to operators and users.
• Do not treat stream closure as cancellation or success. OpenAI’s session-event guidance says streams do not replay missed events, a closed stream does not cancel the task, and agent.session.idle alone is not a success condition.
• Capture the root turn outcome and tool evidence. Recognize turn.failed, turn.cancelled, and session.failed. Even a completed root turn does not prove every tool succeeded, so persist relevant tool results, command items, artifacts, and validation checks.
• Recover before retrying. After a disconnected stream, retrieve the session and saved items, rebuild local state keyed by item ID, account for pagination, then decide whether to continue, cancel, or retry. Blind retries can duplicate work or obscure partial tool output.
• Plan artifact handling by environment type. In OpenAI-hosted environments, files under /workspace/outputs become immutable published artifacts after a turn. Download required artifacts before deleting the session, and remember that deleting an artifact does not delete the live environment file.
• Coordinate subagents explicitly. Multi-agent mode is for independent delegated tasks. Subagents share the same environment filesystem, inherit configured tools and credentials, and do not support function tools, so file edits and privileged operations need coordination.

Pilot design that can survive real failures

A credible pilot should last long enough to capture environment setup failures, stream interruptions, tool errors, reviewer rejections, and cost variance, but it should start with one or two narrow workflows. A good first candidate is “analyze a repository section and produce a review artifact” or “process a bounded file set and publish a report,” because the team can compare output to source files, command logs, and saved artifacts. A weak candidate is “autonomously fix production incidents,” because the agent would need broad credentials, uncertain authority, and fast irreversible decisions.

1. Define the task contract. Specify input files, allowed tools, prohibited actions, expected artifact names, evidence requirements, and a maximum turn budget before the first session is created.
2. Select the environment. Use the OpenAI-hosted sandbox only when its Linux workspace, package setup, file handling, network policy, and container billing model fit the task. Use self-managed or partner infrastructure only when the application team can operate that environment and still accept the Agents API’s retention and residency constraints.
3. Instrument the lifecycle. Log session creation, environment connection, root turn outcome, required actions, tool calls, artifact publication, cancellation, deletion, and recovery decisions. Do not rely on transcript text as the only audit trail.
4. Run a control set. Use representative inputs that include normal tasks, malformed files, unavailable dependencies, network-denied destinations, long-running commands, and conflicting subagent edits if multi-agent mode is enabled.
5. Review evidence before expansion. Require pilot reviewers to inspect artifacts, saved items, tool status, and cost records, then classify each run as accepted, accepted with edits, rejected, failed safely, or failed unsafely.

Acceptance metrics for go/no-go decisions

Workload-selection rules

Choose workloads where the agent can work asynchronously and where partial progress is valuable. Durable sessions are useful when a task can be steered over multiple turns, when files need to persist while the sandbox exists, or when a reviewer may ask for refinement based on saved state. They are less useful for short dependent steps that can be handled by a single deterministic service call or a conventional background job.

Use multi-agent execution only when subtasks are genuinely independent, such as separate research branches, separate test suites, or parallel file inspections that do not require constant handoff. Keep tightly dependent sequences with the main agent, because OpenAI’s multi-agent guide says subagents share one environment filesystem and coordination-item completion does not prove a subagent has finished. If two subagents may edit the same files, require an explicit locking, ownership, or merge-review convention.

Reject workloads that require broad internet access unless the business case justifies the network risk. The hosted sandbox supports enabled, disabled, or restricted network access; restricted mode permits only exact hostnames within the documented limit and does not accept wildcards, protocols, paths, or ports. Redirect destinations and subdomains may need separate entries, and a template’s inherited network policy cannot be broadened by an override.

Failure modes to test before rollout

• Environment setup failure: Session creation succeeds but the environment never reaches connected, or setup commands fail because packages, files, or credentials are missing.
• Stream interruption: The application loses events and must reconnect, buffer new events, retrieve saved items, and rebuild state without assuming replay.
• False success interpretation: The UI reports “done” because the session is idle or a turn completed, even though a tool failed, an artifact is missing, or a subagent never completed useful work.
• Network-policy mismatch: A tool requires a redirected hostname, subdomain, or hosted stdio MCP behavior that the configured network mode does not permit.
• Artifact loss or confusion: The team deletes a session before downloading required outputs, or assumes artifact deletion removes the live workspace file.
• Credential overexposure: Credentials intended for the application backend are made available inside the sandbox or inherited by subagents that do not need them.
• Unbounded spend: A long-running task, repeated retry, high-volume tool call, or hosted container session continues without budget alarms or cancellation authority.
• Beta change impact: A client assumes beta behavior is stable and lacks version checks, release monitoring, regression tests, or rollback procedures.

Rollout stages for enterprises and serious developer teams

Stage 0 should be a paper design review. The team should document the task contract, environment choice, network policy, tool scopes, data classification, cost model, reviewer role, and deletion plan before writing production integration code. This stage should explicitly record any requirement that conflicts with the current public-beta boundaries.

Stage 1 should run in an internal sandbox with non-sensitive data. The goal is to verify session creation, environment readiness, event handling, artifact publication, cancellation, cleanup, and cost telemetry. Developers should inject failures rather than waiting for them, because stream recovery and partial-work inspection are not optional details in the documented lifecycle.

Stage 2 should add representative data and human review. Reviewers should compare agent output with source material and record corrections. Security teams should inspect network destinations, credential paths, tool permissions, and subagent inheritance. Finance or platform teams should compare accepted-output cost against the value of the workflow.

Stage 3 should permit limited production use with rollback. Limit the first production scope by user group, workload type, data class, session budget, and allowed tools. Keep manual fallback procedures active, monitor failed and cancelled turns, and require post-run review until the organization has enough evidence to relax controls.

Stage 4 should expand only after governance evidence improves. Expansion should depend on measured acceptance rates, cost predictability, recovery correctness, security review, and reviewer confidence, not on the mere availability of the public beta. Public beta status means teams should expect evolution before general availability and maintain change-management discipline.

What this launch does not establish

• It does not make the Agents API generally available; OpenAI describes the launch as a public beta.
• It does not make agent execution free; OpenAI says there is no separate Agents API fee during beta, while model tokens, tools, hosted containers, and third-party environments may still be charged.
• It does not provide Zero Data Retention for Agents API sessions, and OpenAI’s documentation states that current data residency support is only in the United States.
• It does not mean a self-hosted sandbox changes the Agents API retention or residency status.
• It does not remove the need for application authorization, tool permissioning, cost budgets, retry logic, session cleanup, observability, or audit procedures.
• It does not prove that a completed turn means every tool succeeded, every subagent finished, or every artifact is correct.
• It does not make hosted sandbox creation synonymous with environment readiness; setup can still be pending or fail.
• It does not make multi-agent mode appropriate for tightly dependent tasks or uncoordinated edits to the same files.
• It does not turn customer-reported outcomes in OpenAI’s launch materials into universal benchmarks for unrelated organizations.
• It does not replace human review in code, security, financial, scientific, regulated, or customer-impacting workflows.

Conclusion: adopt the Agents API as infrastructure, not as autopilot

OpenAI’s Agents API gives developers a managed path to Codex-harness-style execution: durable sessions, hosted or external environments, context management, tool connections, artifacts, and multi-agent delegation. That is a meaningful infrastructure shift because teams can build against a managed orchestration layer instead of assembling every long-running agent primitive themselves.

The launch is still best treated as a controlled adoption opportunity rather than a blanket production mandate. The strongest pilots will select verifiable workloads, constrain tools and networks, preserve session evidence, budget every run, test recovery paths, and require human acceptance for consequential output. Teams that do that work can learn where managed agent infrastructure creates leverage; teams that skip it may simply move ordinary software, security, and governance failures into a faster asynchronous system.

Useful Links

• OpenAI: Introducing the Agents API
• OpenAI Developers: Agents API overview
• OpenAI Developers: Agents API quickstart
• OpenAI Developers: Agents API multi-agent guide
• OpenAI Developers: OpenAI-hosted environments
• OpenAI Developers: API pricing