Keeping Customer Information Out of OpenAI Agents SDK Trace Exports Under Reg S-P

What native controls do and where they stop

Three native levers are relevant: the sensitive data capture setting (trace_include_sensitive_data), the option to disable tracing, and custom trace processors that determine where spans are sent. Data retention arrangements with the provider are a fourth consideration, and they sit outside the SDK.

Each of these is a configuration decision. A capture setting is applied to a deployment, not to a single interaction, so it cannot judge whether a particular value is a customer account number or a harmless string. Disabling tracing removes the exposure but also removes the telemetry your engineers use to debug and your reviewers use to understand agent behavior. A custom processor gives you control over the destination, but it only helps if the data it receives is already safe or if the processor itself applies redaction you have built and tested.

Retention terms need separate attention. A retention or zero data retention arrangement on model API traffic should not be assumed to cover trace data without written confirmation from the provider. Record who confirmed it and when.

The residual exposure is the same in every case: native settings decide whether and where content is recorded, but none of them inspect and act on the content of a specific interaction. Misconfiguration across deployments, new custom spans and tool results with unexpected fields all remain open.

Control-by-control residual exposure

Use this table as a starting point for your own control matrix. Confirm each row against the SDK version and agreements you run.

• Sensitive data capture setting: Addresses: what categories of content spans record. Residual exposure: applied per deployment, not per interaction; inconsistent configuration across services; custom spans written by application code.
• Tracing disabled: Addresses: removes trace creation and export. Residual exposure: loss of debugging and review telemetry; customer information still reaches the model and tools without any content-level control.
• Custom trace processor: Addresses: where spans are sent, including a self-managed store. Residual exposure: the processor receives whatever spans contain unless redaction is built into it; the new destination needs its own access control and retention.
• Retention or zero data retention arrangement: Addresses: how long a provider holds data under the agreement. Residual exposure: scope for trace data must be confirmed in writing; does not prevent customer information from being recorded.
• Runtime policy enforcement in the execution path: Addresses: allow, redact or block decisions on individual model and tool interactions before content reaches a span. Residual exposure: policy coverage depends on which interactions pass through the enforcement point.

What Reg S-P asks of this design

Reg S-P (17 CFR 248.30) is the compliance driver here, and this page is not legal advice. As of November 2026, the rule requires covered institutions to develop, implement and maintain written policies and procedures addressing administrative, technical and physical safeguards for customer information. A written trace-handling policy fits this framework: what agent telemetry may contain, which destinations may receive it, and which controls enforce that.

The rule also contains incident response and notice provisions. A covered institution must give customer notice as soon as practicable, and no later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. Customer information reaching an unapproved trace destination could prompt an assessment under this provision. Whether a given event qualifies is a legal determination for your counsel.

On service providers, the rule requires a provider to notify the covered institution as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system the provider maintains. Whether the model provider or a third-party trace processor is a service provider for your firm, and what contract terms apply, should be settled with counsel before traces flow.

The rule text does not prescribe where in an agent's execution path controls must sit. Placing enforcement before span creation is an engineering judgment. It is a sound one, because it reduces the amount of customer information that ever needs to be covered by notice and oversight arrangements.

Place enforcement in the execution path

The goal is for customer information to be redacted or blocked before it is placed into any structure a span will record. Enforcement after export is a clean-up exercise, not a control.

In practice, this means applying policy at the interaction boundaries where content moves: before a request reaches the model, when a completion returns, before tool arguments are sent and when tool results come back. If a value is redacted at those points, spans built from the redacted content inherit the result. A block decision stops the interaction, so the sensitive payload is never created downstream.

Trussed is one example of this kind of layer. It enforces policy in the execution path across models, agents, tools and MCP servers, with allow, redact, block, rate limit and escalate-for-human-approval actions applied to individual interactions and tool calls. It can be self-managed in the customer cloud, with configurable retention and data residency, which matters when the evidence itself contains sensitive context. Trussed does not provide end-to-end tracing of agentic workflows, and it complements native SDK configuration rather than replacing it.

• Inventory the span types and custom spans your agents emit and mark which can carry customer information.
• Set the sensitive data capture setting explicitly and consistently in every deployment, and treat deviations as findings.
• Define allow, redact and block rules for customer information categories at model and tool-call boundaries.
• Decide the export destination for each environment and route to a self-managed processor where oversight of a third party is not in place.
• Confirm retention terms for trace data in writing with each provider or processor.
• Test with synthetic customer records and inspect the resulting spans before production.