OpenAI Agents SDK: 2-Layer Harness/Compute
Not a finished harness — the primitives for building one. The SDK reference. Module 5 (Sandboxing): 5/5 — the highest-scoring sandbox in the roster. 7 providers, handoffs + agents-as-tools, credential isolation as architecture.
The SDK scores 5/5 on Module 5 (Sandboxing) — the highest in the roster — because of the 7-provider abstraction. One tool, written once, targets 7 isolation regimes (local bash, Docker, E2B, Modal, Daytona, Cloudflare, Vercel) through a uniform interface. Swap by configuration, not code change. The harness code is provider-agnostic. Compare to OpenCode (DD-03): Docker-or-nothing. This is the most architecturally thoughtful sandboxing in the roster.
The 2-layer harness/compute split makes credential isolation architectural, not optional. The harness layer (loop, model calls, credentials) runs on your backend; the compute layer (tool execution) runs in a sandbox. There is no code path in the SDK for credentials to enter the sandbox — you cannot accidentally put creds in the sandbox because the architecture prevents it. A discipline you maintain converted into a property you inherit.
The SDK is the only framework that formalizes BOTH Module 1.3 subagent patterns as first-class primitives. Handoffs (delegation by transfer — terminal, subagent owns task) and agents-as-tools (delegation by query — parent retains control, gets structured result). Most harnesses implement one or neither. This is the 4/5 on Module 10 (Subagents).
The NemoClaw connection is load-bearing: same principle, different layer. NemoClaw (DD-09) places the governance gate OUTSIDE the agent's reach; the SDK places credentials OUTSIDE the sandbox's reach. Both enforce a property by placing the enforcement outside the principal's address space — structurally unreachable. This cross-cutting pattern is what the course wants you to internalize.