Skip to content
Meeno Zen

Writing / Applied AI & systems

What OpenAI's Agents API actually gives you

An agent is a controlled loop around a model. Here is what the surrounding infrastructure actually does.

Meeno Zen
A paper loop passes through blank cards on an ink-navy editorial still life, suggesting an AI agent moving through a bounded workspace.

The phrase Agents API points to a practical shift: a model can sit inside a controlled run that uses tools, carries context and returns an inspectable result[1]. The useful question is what each layer actually does, and where your application must keep control.

An agent is a controlled loop around a model. The model proposes the next step. The surrounding runtime decides what it is allowed to do, runs a tool, returns the result and continues until the task reaches a defined stopping point. A swarm of sub-agents is one possible arrangement inside that loop. It is not the definition of an agent.

That distinction matters because the interesting work is usually outside the sentence the model writes. It is in the evidence it can inspect, the actions it can take, the state it carries, the permissions around those actions and the checks that decide whether the result is ready for a person.

What “Agents API” gives you

For implementation, separate the phrase Agents API from the primitives you will actually configure. The current public developer material describes those primitives through the Responses API and the Agents SDK. The Responses API is the lower-level model-and-tool interface. The Agents SDK adds an application-side way to define agents, run turns, expose tools, arrange handoffs and add guardrails and tracing[2][3].

So this article uses “Agents API” as the reader's entry point, not as the name of a single endpoint. That is the first thing to keep straight. OpenAI also has Workspace Agents inside ChatGPT, a separate product for shared team workflows. An API application and a ChatGPT workspace agent can use related ideas while having different setup, identity, permissions and release controls[4].

Untangle the names before you design the system

Model
The language model proposes text, a tool call or a next decision from the instructions and information it can see. It is the reasoning component, not the whole application.
Agent
In the Agents SDK, an agent is an LLM configured with instructions, tools and optional runtime behaviour such as handoffs, guardrails and structured output[3]. In plain language, it is a goal-directed participant inside a run.
Harness
The software layer that runs the session around the model. It turns a proposed tool call into an actual call, carries state between turns, applies permissions and decides how the run continues. “Harness” is a useful architecture term; it is not a synonym for the model.
Application
The product and business process that own the agent. It defines who may start a run, which data and tools are available, what needs approval and where the final artifact goes.
Orchestration
The control flow between turns, tools and agents. It can be ordinary program logic, a manager calling specialists as tools, or a handoff that transfers the conversation to another agent.

A helpful test is to ask which layer would change if the model changed. If the answer is “the reasoning quality”, you are talking about the model. If the answer is “what can run, what can be recorded or who must approve it”, you are talking about the harness or application.

The loop is the product

A normal chat has a simple shape: input, model response, end. An agent run can repeat the middle. The model receives a goal and the available tools, proposes an action, waits for the result and uses that result to decide what to do next. The SDK's Runner manages those turns when you use the Agents SDK; if you use the Responses API directly, your application owns more of this loop[5].

One run, made visible

The model proposes. The runtime checks.

Every step should leave enough evidence for a reviewer to understand what happened.

01 / Goal

Start with a question and a boundary.

State what the run must produce, which sources are in scope and what it must never change. A request to “investigate the drop” is incomplete until the population, period and acceptable evidence are named.

02 / Choice

Let the model choose among known actions.

The model can decide whether it needs a query, a file search, a calculation or a specialist. It should choose from tools the application has deliberately exposed, not discover unlimited authority.

03 / Result

Return an observation, not a promise.

The tool runs and returns data, an error, a file or a permission decision. The harness puts that result back into the run so the next decision is grounded in what actually happened.

04 / Exit

Stop on a result, a question or a review gate.

A run can finish with a report, ask for missing information, pause for approval or stop because the evidence conflicts. “Keep going until it feels done” is not a control condition.

What the surrounding layers do

Several layers are easy to collapse into one vague word. They are related, but they solve different problems.

Tools
Tools are the actions and observations an agent may request: search, read a record, run code, call a function or edit a file. A tool description tells the model how to ask; the application still owns the implementation and permission.
Model Context Protocol (MCP)
MCP is a protocol for exposing tools and context from another application. It is a connector surface, similar to a standard port. It does not make a model intelligent, turn a server into an agent or remove the need to trust the server and limit its credentials[6].
Skill
A skill is reusable procedure and supporting material that an agent can load when it needs a capability. It can explain a runbook, a file format or a house method. It is an instruction bundle, not another model and not a permission grant[7].
Sandbox
A sandbox is an execution boundary for files, commands and packages. The current Agents SDK describes a SandboxAgent, a manifest and a live sandbox session, with capabilities such as filesystem access, shell, skills, memory and compaction[8]. It can reduce blast radius when configured well; the word alone is not a complete security review.
State and sessions
State is the information needed to continue a run. SDK sessions can retain conversation history across runs, while server-managed continuation is a separate mechanism[9]. Neither should be treated as a governed source of truth. Keep important evidence in explicit records or artifacts.
Artifacts
An artifact is a durable output such as a filtered data file, an investigation record or a report. It gives the next step something inspectable to receive instead of forcing every intermediate detail through the model's conversation.
Tracing and guardrails
Tracing records generations, tool calls, handoffs and guardrails. Input, output and tool guardrails can block or reshape a run at defined points[10]. These controls improve visibility and stop conditions; they do not prove that the underlying answer is correct.

Visual reference

One controlled loop, with the boundaries that make it reviewable.

Open full-size infographic
An agent is a loop with boundaries. A clear four-step path shows the model proposing, tools observing or acting, the harness running turns, state and permissions, and review applying traces, tests and a human stop. Three supporting boundary modules explain context, sandbox and orchestration. Full text follows.
Keep this referenceAn agent loop with visible boundaries.Download infographic
Read the infographic as text

An agent is a loop with boundaries. A model proposes. The runtime checks. The system acts.

01 / ModelProposes the next step.
The language model chooses a response or an available action from the goal and evidence in scope.
02 / ToolsRead, calculate or act.
Tools return observations or perform a bounded operation the application has exposed.
03 / HarnessRuns turns, state and permissions.
The runtime carries the loop and applies the rules around what can happen next.
04 / ReviewTraces, tests and a human stop.
Visibility, guardrails and approval decide whether the result is usable.
ContextMCP, skills and approved evidence.
Connectors and reusable instructions add the context the agent needs without pretending every source is trusted.
SandboxFiles and code inside a chosen boundary.
Code and files run inside an execution boundary with explicit capabilities.
OrchestrationOne agent, specialist or bounded handoff.
Keep one owner when possible; delegate only when the subtask and return format are clear.

More agents do not make a workflow more reliable. Visible boundaries do.

This visual is Meeno Zen's synthesis of the article's cited documentation and the OpenAI announcement. It is an explanatory model, not a vendor diagram or a measured performance claim.

Meeno Zen. Based on “What OpenAI's Agents API actually gives you”. Checked 11 September 2026.

Why code belongs inside some agent runs

Consider an incident investigation that produces more logs than the model should read directly. Programmatic tool calling lets code fetch, filter and aggregate those logs, then return the smaller result the model needs to interpret[11]. That is a division of labour. The model chooses and explains; code performs repeatable reduction.

It is also why “just give the model all the context” is a poor architecture. Raw data can be expensive to move, hard to inspect and easy to truncate. A programmatic step should produce a named artifact with the filters, time window and row counts retained beside it. Do not hide the method inside a clever prompt.

Compaction is continuity, not memory magic

Long investigations need a way to continue after the working context becomes crowded. Compaction creates a summary of earlier work so the agent can proceed[7]. That summary is useful, but it is still a derived representation. Keep the original tool results and decisions in files or structured state so a reviewer can recover the evidence.

The practical rule is simple: summarise for continuity, preserve for verification. A compacted context should point to the evidence it summarises, name unresolved uncertainty and state what the agent is allowed to do next.

Does an agent automatically create a swarm?

No. Multi-agent orchestration is an optional design choice. The current SDK describes two common patterns. With agents as tools, a manager keeps control and asks a specialist for a bounded result. With a handoff, a triage agent transfers the active conversation to a specialist[12].

Stay with one agent

Use one agent when the task has one owner, the tools are already clear and a single report needs a coherent chain of evidence. Fewer handoffs mean fewer places for context and responsibility to become ambiguous.

Call a specialist as a tool

Use a specialist as a tool when it should answer a narrow question but the lead agent must still combine the result, enforce the final format and own the user-facing response.

Hand off the conversation

Use a handoff when a distinct specialist should take over the rest of the turn, with its own instructions and scope. Make the handoff payload explicit and record why it happened.

One useful arrangement is to let a specialist inspect recent code changes while another checks telemetry, then ask a lead agent to unify the findings[1]. That is a sensible pattern when the work is genuinely independent and the merge is reviewable. It is wasteful when the task is a short lookup or when no one can say what each specialist is responsible for.

Workflow or agent?

A fixed workflow and an agent are not competing moral positions. They are different control choices. Anthropic's architecture guidance recommends starting with the simplest augmented model, adding a workflow when the path is predictable and using an agent when the model needs to direct flexible steps[13].

Choose the control shape

Let the uncertainty decide.

Keep the boundaries deterministic even when the route inside them is adaptive.

Known path

Use a workflow.

Choose it when the same stages run in the same order, each stage has a clear input and output, and a normal program can validate the transition. A scheduled report with fixed extracts and checks belongs here.

Changing evidence

Use an agent inside boundaries.

Choose it when the next useful action depends on what the previous tool reveals, the evidence is messy and a person would normally investigate by choosing among several known actions.

Mixed work

Use both.

Put permissions, schemas, review gates and output formats in ordinary code. Let the agent choose the bounded investigation steps between those gates.

A Digital Performance Investigation Agent

Imagine a request: “Investigate the fall in paid-search enquiries last week and prepare a report for the performance meeting.” The following is a proposed architecture, not a deployed Meeno system and not a result from real data.

  1. Define the contract.

    Record the site, channel, local-time window, enquiry event, comparison period, source systems and the decision the report will support.

  2. Give the lead agent read-only tools.

    It can query approved analytics, retrieve the release log and read the measurement runbook. It cannot edit tags, publish a campaign or change a dashboard.

  3. Let code reduce the evidence.

    A programmatic call groups events by day, checks the event definition and writes a small evidence file with filters and freshness attached.

  4. Delegate only when the evidence requires it.

    A telemetry specialist can inspect a release change or a data-quality specialist can reconcile a missing day. Each returns a structured finding, uncertainty and source reference.

  5. Assemble a report.

    The lead agent separates observed change, possible explanations, evidence still missing and suggested next checks. It does not call a correlation a cause.

  6. Pause for the meeting owner.

    A human accepts the scope and decides what action to take. The run ends with a shareable report and its evidence bundle.

The interesting part is the contract and the stop condition. The agent is allowed to investigate, not to turn an uncertain explanation into a production change. That boundary makes the result easier to review and the next run easier to improve.

A safer way to build the first one

Start small enough that a person can inspect every turn. The OpenAI SDK documentation recommends monitoring, specialised agents where they are useful, structured outputs and evals as systems become more complex[12]. A practical sequence is:

  1. Start with one bounded agent

    One agent, one read-only tool and one defined output.

  2. Make the output inspectable

    Structured output with explicit unknowns, sources and stop reasons.

  3. Test the failure paths

    Trace the run and test tool errors, empty results, stale data and refusal paths.

  4. Reuse a stable procedure

    Add a skill when the procedure is stable enough to reuse.

  5. Connect a separate system

    Add MCP when a separate system needs a standard, permissioned connector.

  6. Contain code execution

    Add a sandbox when code, files or packages need an execution boundary.

  7. Add a specialist selectively

    Add a specialist only when the subtask is independent and its handoff can be checked.

  8. Keep the human decision gate

    Keep a human approval gate for consequential actions and publish a report of what happened.

OpenAI's SDK provides deterministic testing utilities for SDK-owned tool execution, handoffs, guardrails, retries, sessions and sandbox capabilities, while provider behaviour still needs integration testing[14]. That distinction is easy to lose in a demo. A green orchestration test proves that the plumbing followed the contract; it does not prove that the model understood a messy business question.

The question to ask before adding another agent

Before you add a specialist, ask: What decision will this extra agent make, what evidence will it receive, and how will the lead agent know whether its answer is usable? If those answers are vague, another agent will add motion without adding control.

The useful boundary is this: a model can sit inside a longer, tool-using, observable run without you writing every piece of session and context plumbing from scratch. The engineering responsibility remains yours: define the boundary, keep the evidence visible, test the handoff and give a person a clear place to stop the system.

Sources14 references

Evidence & further reading

Numbered references in the article point to the documents below. Each title opens the original source.

  1. 01
  2. 02
  3. 03

    OpenAI Agents SDK

    Agents
  4. 04
  5. 05

    OpenAI Agents SDK

    Quickstart
  6. 06

    OpenAI Agents SDK / MCP maintainers

    Model Context Protocol
  7. 07
  8. 08

    OpenAI Agents SDK

    Sandbox agent concepts
  9. 09

    OpenAI Agents SDK

    Sessions
  10. 10

    OpenAI Agents SDK

    Tracing Guardrails
  11. 11

    OpenAI Agents SDK

    Tools
  12. 12

    OpenAI Agents SDK

    Agent orchestration
  13. 13
  14. 14

    OpenAI Agents SDK

    Testing