> ## Documentation Index
> Fetch the complete documentation index at: https://docs.declaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenAI Agents SDK — quick start

> Run an OpenAI Agents SDK agent inside a declaw sandbox with full security guardrails enabled — ~20 lines of glue, no changes to agent logic.

A runnable example that swaps the agent's execution backend to declaw.
Every tool call the agent makes (bash, file I/O, PTY) runs inside the
sandbox, with declaw's security policy enforced at the VM's network
boundary.

## What you'll learn

* Installing the integration with `pip install "declaw[openai-agents]"`
* Wiring a `DeclawSandboxClient` into the Agents SDK's `Runner`
* Enabling PII + prompt-injection scanning and a network allowlist
  from the same `SecurityPolicy` surface you use with the core SDK

## Prerequisites

<Snippet file="snippets/env-setup.mdx" />

Also:

```bash theme={null}
export OPENAI_API_KEY="sk-..."
pip install "declaw[openai-agents]"
```

## Code

```python theme={null}
import asyncio
import os
import sys

from agents import Runner
from agents.run import RunConfig
from agents.sandbox import SandboxAgent, SandboxRunConfig

from declaw.openai import (
    DeclawSandboxClient,
    DeclawSandboxClientOptions,
    InjectionDefenseConfig,
    PIIConfig,
    SandboxNetworkOpts,
    SecurityPolicy,
)


async def main() -> None:
    options = DeclawSandboxClientOptions(
        template="python",
        timeout=300,
        security=SecurityPolicy(
            pii=PIIConfig(enabled=True, action="redact"),
            injection_defense=InjectionDefenseConfig(enabled=True, sensitivity="medium", domains=["api.openai.com"]),
        ),
        network=SandboxNetworkOpts(
            allow_out=["api.openai.com", "pypi.org", "files.pythonhosted.org"],
        ),
    )

    client = DeclawSandboxClient()
    session = await client.create(options=options)
    try:
        agent = SandboxAgent(
            name="quickstart",
            model="gpt-5.4",
            instructions="You are a helpful coding agent.",
        )
        result = await Runner.run(
            agent,
            "Create /workspace/notes.md with 'hello from declaw', then "
            "run `wc -c /workspace/notes.md` and report the byte count.",
            run_config=RunConfig(sandbox=SandboxRunConfig(session=session)),
        )
        print(result.final_output)
    finally:
        await client.delete(session)


if __name__ == "__main__":
    asyncio.run(main())
```

## Expected output

```
I've written the file and measured it:
- /workspace/notes.md — 18 bytes
```

(Content will vary slightly — the agent may add a trailing newline or
re-format the sentence.)

## How the security policy applies

Everything inside `SecurityPolicy(...)` is enforced by the
sandbox's edge proxy, not by the adapter:

* `pii=PIIConfig(enabled=True, action="redact")` — any outbound HTTP
  request the agent's tool code makes that contains PII has the
  matches replaced with `REDACTED_*` tokens before the request
  reaches the upstream. Responses are rehydrated transparently so
  the sandbox program keeps working.
* `injection_defense=InjectionDefenseConfig(enabled=True, sensitivity="medium", domains=["api.openai.com"])`
  — outbound payloads are scanned for prompt-injection patterns.
  Injection scanning is per-domain: only requests to hosts listed in
  `domains` are scanned, so the upstream LLM host must be named there.
* `SandboxNetworkOpts(allow_out=[...])` — the allowlist is enforced
  at the network namespace level; any outbound connection to a
  host not in the list is dropped.

None of this lives in the adapter code — you're using the exact same
`SecurityPolicy` surface as `Sandbox.create(security=...)` in the core
SDK.

## Next steps

* Build on this example in the [PII end-to-end cookbook](/cookbook/openai-agents-security).
* Browse the full [`declaw.openai` reference](/sdks/python/openai-agents).
* See the [Security overview](/security/overview) for the complete
  scanner list and policy reference.