Repository: openai/openai-agents-python

Issue:
Add support for global or environment-based default for `trace_include_sensitive_data` in `RunConfig`
### Please read this first

- **Have you read the docs?** [Agents SDK docs](https://openai.github.io/openai-agents-python/) => yes
- **Have you searched for related issues?** => yes

### Describe the feature
Here’s a template for a feature request you could submit to the upstream [`openai/openai-agents-python`](https://github.com/openai/openai-agents-python) library. This template is tailored to your use case (wanting a global or environment-based way to set `trace_include_sensitive_data` for all `RunConfig` and `Runner.run` calls):

---
Hello!

**Description and Motivation:**  
In our usage of the library, we want to ensure that `trace_include_sensitive_data` is always set to `False` for all agent runs, to avoid accidentally leaking sensitive data in traces. Currently, this requires us to pass a custom `RunConfig` with `trace_include_sensitive_data=False` to every call to `Runner.run` or similar entry points, which is error-prone and adds boilerplate.

**Proposed Solution:**  
It would be extremely helpful to support a way to set the default value of `trace_include_sensitive_data` globally, or via an environment variable, so that this setting is consistently applied across the application without needing to modify every callsite.

Possible options include:

- Allowing `RunConfig` to read `trace_include_sensitive_data` from an environment variable (e.g., `OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA=false`) if not explicitly set.
- Adding a global configuration method or context manager that sets the default for all subsequent `RunConfig` instances.
- Accepting a default value via a module-level setter, e.g., `set_trace_include_sensitive_data_default(False)`.

**Example:**  
```python
# Option 1: environment variable
# export OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA=false

# Option 2: programmatic global default
from openai.agents import set_trace_include_sensitive_data_default
set_trace_include_sensitive_data_default(False)
```

**Benefits:**  
- Reduces risk of leaking sensitive data due to missing config at a single callsite.
- Makes application-wide security posture easier to enforce.
- Reduces code duplication and boilerplate.

**Alternatives considered:**  
- Creating local wrappers for `Runner.run` (works, but error-prone and easy to miss in large codebases).
- Monkey-patching (brittle and discouraged).

Would you consider adding this feature, or is there an existing pattern recommended for this use case?

Thank you for your excellent work on the library!
(PS: I've obviously used an LLM to write this Feature request, it's hard to beat the clarity of an LLM)



Discussion:
Makes sense, would be open to a PR with an env var



Patch:
diff --git a/src/agents/run.py b/src/agents/run.py
index 2dd9524bb..0a7d3afb4 100644
--- a/src/agents/run.py
+++ b/src/agents/run.py
@@ -3,6 +3,7 @@
 import asyncio
 import copy
 import inspect
+import os
 from dataclasses import dataclass, field
 from typing import Any, Generic, cast
 
@@ -81,6 +82,12 @@ def get_default_agent_runner() -> AgentRunner:
     return DEFAULT_AGENT_RUNNER
 
 
+def _default_trace_include_sensitive_data() -> bool:
+    """Returns the default value for trace_include_sensitive_data based on environment variable."""
+    val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "true")
+    return val.strip().lower() in ("1", "true", "yes", "on")
+
+
 @dataclass
 class RunConfig:
     """Configures settings for the entire agent run."""
@@ -114,7 +121,9 @@ class RunConfig:
     """Whether tracing is disabled for the agent run. If disabled, we will not trace the agent run.
     """
 
-    trace_include_sensitive_data: bool = True
+    trace_include_sensitive_data: bool = field(
+        default_factory=_default_trace_include_sensitive_data
+    )
     """Whether we include potentially sensitive data (for example: inputs/outputs of tool calls or
     LLM generations) in traces. If False, we'll still create spans for these events, but the
     sensitive data will not be included.


Test patch:
diff --git a/tests/test_run_config.py b/tests/test_run_config.py
index e19899006..31d6d0a46 100644
--- a/tests/test_run_config.py
+++ b/tests/test_run_config.py
@@ -86,3 +86,55 @@ async def test_agent_model_object_is_used_when_present() -> None:
     # the FakeModel on the agent.
     assert provider.last_requested is None
     assert result.final_output == "from-agent-object"
+
+
+def test_trace_include_sensitive_data_defaults_to_true_when_env_not_set(monkeypatch):
+    """By default, trace_include_sensitive_data should be True when the env is not set."""
+    monkeypatch.delenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", raising=False)
+    config = RunConfig()
+    assert config.trace_include_sensitive_data is True
+
+
+@pytest.mark.parametrize(
+    "env_value,expected",
+    [
+        ("true", True),
+        ("True", True),
+        ("1", True),
+        ("yes", True),
+        ("on", True),
+        ("false", False),
+        ("False", False),
+        ("0", False),
+        ("no", False),
+        ("off", False),
+    ],
+    ids=[
+        "lowercase-true",
+        "capital-True",
+        "numeric-1",
+        "text-yes",
+        "text-on",
+        "lowercase-false",
+        "capital-False",
+        "numeric-0",
+        "text-no",
+        "text-off",
+    ],
+)
+def test_trace_include_sensitive_data_follows_env_value(env_value, expected, monkeypatch):
+    """trace_include_sensitive_data should follow the environment variable if not explicitly set."""
+    monkeypatch.setenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", env_value)
+    config = RunConfig()
+    assert config.trace_include_sensitive_data is expected
+
+
+def test_trace_include_sensitive_data_explicit_override_takes_precedence(monkeypatch):
+    """Explicit value passed to RunConfig should take precedence over the environment variable."""
+    monkeypatch.setenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "false")
+    config = RunConfig(trace_include_sensitive_data=True)
+    assert config.trace_include_sensitive_data is True
+
+    monkeypatch.setenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "true")
+    config = RunConfig(trace_include_sensitive_data=False)
+    assert config.trace_include_sensitive_data is False