diff --git a/sdk/guides/security.mdx b/sdk/guides/security.mdx index e895fc2f..5495facf 100644 --- a/sdk/guides/security.mdx +++ b/sdk/guides/security.mdx @@ -442,6 +442,55 @@ agent = Agent(llm=llm, tools=tools, security_analyzer=security_analyzer) For more details on the base class implementation, see the [source code](https://github.com/OpenHands/software-agent-sdk/blob/main/openhands-sdk/openhands/sdk/security/analyzer.py). +--- + +## Configurable Security Policy + +Agents use security policies to guide their risk assessment of actions. The SDK provides a default security policy template, but you can customize it to match your specific security requirements and guidelines. + + +Full configurable security policy example: [examples/01_standalone_sdk/31_configurable_security_policy.py](https://github.com/OpenHands/software-agent-sdk/blob/main/examples/01_standalone_sdk/31_configurable_security_policy.py) + + +### Security Policy Example + +Define custom security risk guidelines for your agent: + +```python icon="python" expandable examples/01_standalone_sdk/31_configurable_security_policy.py +``` + +```bash Running the Example +export LLM_API_KEY="your-api-key" +cd agent-sdk +uv run python examples/01_standalone_sdk/28_configurable_security_policy.py +``` + +### Using Custom Security Policies + +You can provide a custom security policy template when creating an agent: + +```python highlight={10-11} +from openhands.sdk import Agent, LLM +from pathlib import Path + +llm = LLM( + usage_id="agent", + model="anthropic/claude-sonnet-4-5-20250929", + api_key=SecretStr(api_key), +) + +# Provide a custom security policy template file +agent = Agent(llm=llm, tools=tools, security_policy_filename="my_security_policy.j2") +``` + +Custom security policies allow you to: +- Define organization-specific risk assessment guidelines +- Set custom thresholds for security risk levels +- Add domain-specific security rules +- Tailor risk evaluation to your use case + +The security policy is provided as a Jinja2 template that gets rendered into the agent's system prompt, guiding how it evaluates the security risk of its actions. + ## Next Steps - **[Custom Tools](/sdk/guides/custom-tools)** - Build secure custom tools