Skip to content
AI agent contracts: three clauses to sign before the work
Back to Blog
#OpenAI Agents API#RubyGems#AI agent security#software supply chain#sandbox network policy#AI procurement#reshaped-v3

AI agent contracts: three clauses to sign before the work

Sadaf Masood

Three clauses, and they are short. First, a disclosure duty that triggers on access rather than on your supplier's opinion of it. Second, a requirement that the agent's network policy lives in an environment template, not in a flag a developer sets per run. Third, the host list itself, in writing, reissued every time it changes. Everything else in an agent statement of work is ordinary software contracting; those three are what make the agent auditable.

Write the disclosure clause so "benign" cannot end it

Because the operator's judgement is where these disclosures currently stop. In May 2026 newly registered accounts ran a spam-publishing campaign against rubygems.org. The registry paused new account registrations, removed the accounts and yanked more than 500 malicious packages, reopening registrations on 16 May. The packages were designed to use shared Ruby infrastructure to run code, retrieve public web data and publish it back to the registry, and researchers also found code intended to obtain other users' API keys; RubyGems found no evidence those attempts succeeded.

What matters for your contract is the date on that post: 11 September. Ruby Central's technical lead opens it by saying the team is clarifying what it knows "following reporting by The Wall Street Journal and the publication of research by Nightingale Collective". The registry learned who had been on its infrastructure four months later, from journalists and outside researchers. Asked about it, OpenAI's position was that its agents "used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information".

"Based on the evidence available to us, we cannot determine whether the packages were created or published by AI agents."

— Colby Swandale, Technical Lead, Ruby Central, 11 September 2026

Both statements can be true at once. Neither is a notification. So write the trigger as the event, not the assessment: the supplier notifies you within a fixed number of business days of becoming aware that any automated agent it or its sub-processors operate has accessed systems, registries or infrastructure belonging to you or to any third party, whether or not the supplier considers the access benign. Pick the number of days yourself. If you are inside a regime with its own incident clock, make it shorter than that clock.

Put the network policy in the template, not the session

Because the platform default is open. OpenAI's hosted sandbox documentation sets out three network settings, and of the first it says plainly: "Allow outbound access. This is the default unless you inherit a template policy." A session that says nothing about the network has the internet. The other two settings block outbound access entirely, or restrict it to a named list.

The same page gives you the control worth naming in a contract: sessions inherit an environment template, and "network overrides cannot broaden its policy". A developer can ask a session for open access and the template still wins. That is the difference between a policy you can audit and a policy that depends on everyone remembering a flag. Require that every session your supplier runs on your work inherits a named template, and that the template is the artefact produced on request.

Ask for the host list, and ask again after every change

Restricted mode accepts between one and one hundred exact host names, with no wildcards, protocols, paths or ports. That constraint is useful to you: the list is finite, readable and checkable by someone who is not an engineer. Ask for it as a document, ask for a fresh copy whenever it changes, and read the entries.

If the supplier cannot produce the list, they do not know what the agent reaches — and the RubyGems case is what that looks like from the other end, where the party whose infrastructure was used found out from a newspaper. A one-page annex naming the template, the hosts and the notification clock costs nothing to write before the work starts and is unwritable afterwards.

If you want these three clauses looked at against a statement of work you have already been sent, send it to Vesprr Software.

Sources