OpenAI Agents SDK for Python 0.24

Apply the included OpenAI SDK for Python and Python baselines first. These rules cover the OpenAI Agents SDK for Python 0.24 line, including Runner, tools, handoffs, approvals, sessions, tracing, and sandbox agents.

Prompt injection and agent boundaries

• Keep Agent.instructions, dynamic instruction callbacks, tool registries, and RunConfig under application control. Treat user messages, retrieved files, MCP responses, tool output, and sandbox memories as untrusted data; never promote them into instructions or permission grants.
• Authorize handoff targets and Agent.as_tool() delegates for the current principal. For model-supplied handoff metadata, use a narrow handoff(input_type=...) schema and authorize parsed fields at the start of on_handoff, before side effects; raise on denial because returning normally continues the transfer. A model-selected delegate must not acquire broader credentials.
• Filter handoff history with input_filter to the receiving agent's data scope, including text copied into summaries; nest_handoff_history is not redaction. Server-managed conversations do not support these filters: start a separate run with explicitly selected input and without the original conversation_id or previous_response_id when isolation is required.
• Use input_guardrail(run_in_parallel=False) when rejection must precede model or tool execution. Input guardrails run on the first agent; the default parallel mode can already consume tokens and execute tools before rejection.
• Place checks at each actual protected operation: handoffs, hosted tools,