Agents

Overview

A hosted agent is a saved configuration (model, instructions, tools, limits) that the platform runs for you against a task. Agents have no special privileges: every model call goes through the same inference pipeline as the public API, and every tool execution through the same sandbox service. Policies, rate limits, budgets, billing and receipts apply to each step exactly as they would to your own requests.

Configuration

How a run executes

A run starts from a task of 1–50,000 characters. It is queued, then executed once; a run cannot be claimed twice.

1. The model is called with the agent's instructions, the conversation so far and the allowed tool definitions. The call uses the run's remaining budget as a cost ceiling.
2. If the model answers without calling tools, that answer is the run's output and the run succeeded.
3. Otherwise each tool call is executed in order. Results are appended to the conversation as tool messages, and the loop returns to step 1.
4. The run stops when the model finishes, the budget cannot cover the next operation, an unrecoverable error occurs, the step limit is reached, or 10 minutes of wall-clock time pass.

Tools

Tools are resolved from a registry. sandbox.execute is presented to the model as the function sandbox_execute:

{
  "name": "sandbox_execute",
  "description": "Execute Python or Node.js code in an isolated sandbox with no network access, a 30 second limit and capped output. Returns exit code, stdout and stderr.",
  "parameters": {
    "type": "object",
    "properties": {
      "runtime": { "type": "string", "enum": ["python", "node"] },
      "code": { "type": "string", "description": "Complete program source. Print results to stdout." }
    },
    "required": ["runtime", "code"],
    "additionalProperties": false
  }
}

• Executions run with the standard sandbox limits: no network, at most 30 seconds, capped memory, CPU, processes and output.
• The tool result returned to the model contains the status, exit code, up to 8,000 characters of stdout and up to 4,000 characters of stderr.
• Calls to tools the agent is not allowed to use, invalid arguments, and failed executions are reported back to the model as tool errors rather than ending the run.

Run budgets

The run budget is enforced before each operation, not after:

• Model calls. Output tokens are capped at what the remaining budget can pay for after the estimated input cost. If fewer than 64 tokens are affordable, the call is refused.
• Sandbox executions. The execution is refused if its reservation, the cost of its full timeout, exceeds the remaining budget.

A refused operation ends the run with status budget_exceeded. The project balance, project monthly budget and project rate limit also apply. API key limits do not, because runs are not made with an API key. See Budgets.

Receipt chains

Each billed step issues a normal receipt whose run field carries the run ID, a sequence number and the previous receipt's hash. Because the link is inside the signed payload, a run's receipts form a verifiable chain: none can be removed or reordered without detection. The run record stores the number of receipts, the total cost and a chain head over all receipt hashes.

sequence 0  inference.chat   previous_receipt_hash: null
sequence 1  sandbox.execute  previous_receipt_hash: hash(receipt 0)
sequence 2  inference.chat   previous_receipt_hash: hash(receipt 1)

receipt_head = keccak256(keccak256(keccak256(0x00…00 ‖ h0) ‖ h1) ‖ h2)

See Receipts and Receipt Verification.

Run statuses

Data handling

• Agent instructions, run task input and run output are encrypted at rest.
• Receipts for agent steps contain only salted fingerprints of inputs and outputs, never the content. Salts for agent steps are held by the platform and are not returned through the public API.
• Agent steps are billed to the project that owns the agent.

Availability