Skip to main content
New to the adapters? Start with the wrapping overview and comparison table.
Compatible versions: see the compatibility table for the verified openai-agents range.

HexgateRunner

HexgateRunner is a drop-in replacement for agents.Runner. It wraps the agent’s tools with a PolicyEnforcer at construction time and opens a HexgateContext scope around each Runner.run / run_sync / run_streamed call so role resolution happens at call time.

Under the hood

  • HexgateRunner.run calls wrap_openai_agent, which builds a PolicySet for (api_key, agent.name, tool_names), constructs one PolicyEnforcer, and returns a dataclasses.replace’d copy of the agent with policy-gated tool copies — your original agent is untouched.
  • The runner opens an async with hexgate_context: scope around the underlying Runner.run* call. When the model calls a tool, the guard asks enforcer.decide(...) for a Decision. On non-allow, it returns decision.as_error_message() — a [policy_denied] or [approval_required] markered string the model can interpret and recover from.
  • The run executes inside propagate_attributes(user_id=..., session_id=..., metadata={"user_roles": ...}), so Langfuse spans carry the caller identity.
run_sync and run_streamed work the same way.

Runnable example

examples/devops_openai.pyHexgateRunner (OpenAI Agents SDK) end-to-end.