Skip to main content
A runnable example that swaps the agent’s execution backend to declaw. Every tool call the agent makes (bash, file I/O, PTY) runs inside the sandbox, with declaw’s security policy enforced at the VM’s network boundary.

What you’ll learn

  • Installing the integration with pip install "declaw[openai-agents]"
  • Wiring a DeclawSandboxClient into the Agents SDK’s Runner
  • Enabling PII + prompt-injection scanning and a network allowlist from the same SecurityPolicy surface you use with the core SDK

Prerequisites

Also:

Code

Expected output

(Content will vary slightly — the agent may add a trailing newline or re-format the sentence.)

How the security policy applies

Everything inside SecurityPolicy(...) is enforced by the sandbox’s edge proxy, not by the adapter:
  • pii=PIIConfig(enabled=True, action="redact") — any outbound HTTP request the agent’s tool code makes that contains PII has the matches replaced with REDACTED_* tokens before the request reaches the upstream. Responses are rehydrated transparently so the sandbox program keeps working.
  • injection_defense=InjectionDefenseConfig(enabled=True, sensitivity="medium", domains=["api.openai.com"]) — outbound payloads are scanned for prompt-injection patterns. Injection scanning is per-domain: only requests to hosts listed in domains are scanned, so the upstream LLM host must be named there.
  • SandboxNetworkOpts(allow_out=[...]) — the allowlist is enforced at the network namespace level; any outbound connection to a host not in the list is dropped.
None of this lives in the adapter code — you’re using the exact same SecurityPolicy surface as Sandbox.create(security=...) in the core SDK.

Next steps