On Sept 7, 2026, TestingCatalog reported finding code for a 'Managed Agent' creation UI that would let users create agents and environments and run them on self-hosted infrastructure. It said the product 'broadly follows' Anthropic's Claude Managed Agents. The report spread on X and Telegram, and the newsroom flagged it because the posts didn't separate the mechanism, its limits and whether the claims could be checked. The hypothesis to test: managed agents only become a real platform surface if OpenAI turns execution, identity, permissions and audit into a public product contract.
Six weeks later the question has an answer. OpenAI launched the Agents API in public beta on Sept 10. It is a hosted version of the Codex harness. At DevDay on Sept 29, OpenAI added computer use, and AWS opened a preview of Bedrock Managed Agents, which runs on a customized version of the same API. For builders, the useful question is no longer whether the product exists. It is which contract covers which controls.
What we checked
- Will Managed Agents become their own platform surface only if OpenAI puts execution, identity, permissions and audit trail into a public product contract? partly confirmed. OpenAI shipped a standalone surface, the Agents API, with a public contract for Agent, Environment, Session and events and for the hosted vs self-hosted execution boundary. Its docs do not define a permissions model, secrets handling or audit logs. Per-agent IAM roles, human approval for consequential actions and CloudTrail auditing are in the AWS contract for Bedrock Managed Agents only. So execution reached a public contract and identity/permissions/audit did not, yet the product still launched. The 'only if' condition did not hold for OpenAI's own API. [2][3][5]
- (Added) Was the pre-DevDay TestingCatalog report of an upcoming OpenAI 'managed agents' product accurate? confirmed. TestingCatalog's speculative Sept 7 report described a managed-agent creation UI, agents and environments, and self-hosted execution. OpenAI's changelog shows the Agents API entering public beta on Sept 10 with OpenAI-hosted and self-hosted sandboxes. [9][1]
- (Added) Did OpenAI publish an explicit Agent/Environment/Session contract before DevDay (Sept 29)? confirmed. Yes. The Sept 10 beta docs define Agent (model, instructions, tools, MCP servers), Environment (none, openai_hosted or self_hosted), Session (a durable agent instance) and events/items. Endpoints sit behind the OpenAI-Beta: agents=v1 header. Explicit rules for permissions and logging were not part of it. [2][1]
What we found
- OpenAI's changelog dates the Agents API public beta to Sept 10, 2026. The service runs on a managed Codex harness, and OpenAI handles session orchestration, context compaction and recovery. Durable sessions carry work across turns, in OpenAI-hosted sandboxes or ones you connect yourself. Later entries added computer use in an OpenAI-hosted browser (Sept 29, 'your application handles website access approvals and sign-in'), sandbox prewarming with compute billed only during active turns (Oct 9), and sandbox document skills and Ultrafast mode (Oct 16). [1]
- The public contract names four concepts. Agent covers the model, instructions, tools and MCP servers. Environment is optional and is none, openai_hosted or self_hosted. Session is a durable agent instance. Events and items carry inputs and outputs. The architecture page sets the execution boundary: the harness always runs on OpenAI's servers, and with self_hosted you handle provisioning, reconnection, shutdown and keeping files. Function tools run in your code, while the harness calls remote MCP tools directly. Progress is visible through streaming events and webhooks. [2][3]
- OpenAI's Agents API docs do not describe a permissions model, secrets storage, network policy or audit logging. Approval appears only in an example (an incident-response agent that can 'request approval for recovery actions') and in the computer-use website-access approvals. Data residency is US-only, and the API is not eligible for Zero Data Retention, even with a self-hosted sandbox. Model usage, OpenAI tools and hosted containers are billed at standard rates. [2][1]
- The self-hosted option still leaves OpenAI in control of the agent. OpenAI runs the harness, and you run
codex exec-server, which opens outbound-only connections to api.openai.com and a WebSocket endpoint. A dedicated environment key that can only connect environments is passed into the sandbox, and agent-generated code can read it. The docs warn that agents sharing an environment share files and credentials, so you should isolate environments by user or workload. This is the closest the OpenAI docs come to a permission boundary. [4] - Identity, permissions and audit do appear in AWS's contract. Bedrock Managed Agents, announced in preview on Sept 29 and built with OpenAI on a customized Agents API, gives each agent its own IAM role and supports human approval before consequential actions. It logs supported API activity to CloudTrail. The preview runs in three US regions, with no BMA charge beyond the underlying AWS resources. OpenAI's own docs warn that sharing concepts with BMA doesn't mean the API contracts or features are identical: BMA uses IAM/SigV4 and runs inference on Bedrock, while the OpenAI API uses project keys. [5][6]
- On OpenAI's own platform, the identity work in this period sits at the API-key layer. Admins can set key expiration and a maximum key lifetime (Sept 10) and restrict key creation to service accounts or user-owned keys (Sept 15). For the consumer-facing Dots, TechCrunch reports that specialist Dots 'can be provisioned with specific identities, credentials, and tools through existing systems.' OpenAI is also working with Microsoft on Agent 365 security controls, with no mechanism described. [1][7]
- Independent analysts quoted by InfoWorld call lock-in 'the biggest concern', because OpenAI supplies the model, context management, orchestration and execution. They say the missing ZDR could slow adoption in regulated sectors. InfoWorld lists third-party sandbox providers including Cloudflare, E2B, Modal, Vercel and Daytona. It names Anthropic's Claude Managed Agents, AWS AgentCore and Microsoft Foundry Agent Service as competitors. InfoWorld dates the launch Sept 11, while OpenAI's changelog says Sept 10. [8]
What it means
Treat OpenAI's Agents API as a hosted execution and session layer, not a governance layer. Its contract tells you clearly where the loop runs (always on OpenAI), where commands run (none, OpenAI-hosted or your own sandbox) and how state persists (durable sessions, compaction, webhooks). It does not give you per-agent identity, scoped permissions, a policy engine or an audit trail. Build those yourself. Expose sensitive actions as function tools that your own server runs, so authorization and logging stay with you. Use one environment per user or workload, because agents sharing an environment share its credentials. Store a log of the stream/webhook events in your own system as the audit record. Teams in regulated industries should note the missing ZDR and the US-only residency before committing.
If you need IAM-scoped agent identity, approval gates and CloudTrail now, the Bedrock Managed Agents preview is the version that has them in a contract. It is a different API with different auth and endpoints, and OpenAI explicitly warns against assuming parity. In practice OpenAI's harness ships through two channels, and the enterprise controls currently depend on the cloud partner's contract. Keep your agent definitions portable (instructions, MCP servers, skills) to limit the lock-in risk analysts flag. Watch for OpenAI to add native permission and audit primitives before the beta label comes off.
Still open
- Will OpenAI add per-agent identity, scoped permissions, approval policies and audit logs to the Agents API itself before general availability, or leave them to partners like AWS and Microsoft?
- When will the Agents API leave beta, and will ZDR eligibility or residency outside the US follow?
- How far does Bedrock Managed Agents' 'customized' Agents API differ from OpenAI's (models, tools, session semantics)? What pricing will BMA have at general availability?
- How will specialist Dots' identities and the Agent 365 integration work, and will developers get any of it through the API?