Add Guardrails and Human Approval

OpenAI guardrails automatically validate input, output, or function-tool behavior; human approval pauses a run before a sensitive tool executes. Guardrails are checks, not universal policy coverage. Put validation beside each consequential tool, persist interruption state, and revalidate current business conditions before resuming an approved action.

What will you be able to do?

You will mark a mutating tool for approval, handle interruptions, and explain where agent-level guardrails do and do not run.

How do you pause a tool call?

approval_demo.py:

python

import asyncio

from agents import Agent, Runner, function_tool


@function_tool(needs_approval=True)
async def apply_ticket_label(ticket_id: str, label: str) -> str:
    """Apply an approved label to a ticket. Demo only."""
    return f"Applied {label} to {ticket_id}"


agent = Agent(
    name="Support label assistant",
    instructions="Propose a label when useful. The application handles approval.",
    tools=[apply_ticket_label],
)


async def main() -> None:
    result = await Runner.run(agent, "Label T-100 as billing-review.")

    if not result.interruptions:
        print(result.final_output)
        return

    state = result.to_state()
    for interruption in result.interruptions:
        # A real application displays exact arguments and verifies the approver.
        state.approve(interruption)

    resumed = await Runner.run(agent, state)
    print(resumed.final_output)


if __name__ == "__main__":
    asyncio.run(main())

Never auto-approve in production as the example does. Store the state, show the exact proposed action and impact to an authorized reviewer, record the decision, then resume.

Where do guardrails run?

Input guardrails evaluate the initial agent input.
Output guardrails evaluate the agent producing final output.
Tool guardrails wrap the function tools to which they are attached.

Agent-level checks do not automatically wrap every nested tool in every orchestration pattern. Put critical authorization and validation in the tool gateway or handler even when an agent guardrail also exists.

How do you prove approval is real?

Test that:

the handler never runs before approval;
rejection resumes with a denied result rather than execution;
only an authorized role can decide;
approval binds to exact arguments and expires;
changed business state invalidates stale approval; and
the same state cannot commit twice.

Failure injection: Approve label=billing-review, then alter the stored proposal to label=resolved. A cryptographic/integrity binding or server-side proposal record must detect the change.

What mistakes should you avoid?

Asking the model whether an action is allowed.
Showing a vague “approve agent” dialog instead of exact impact.
Assuming input/output guardrails cover nested tools.
Resuming with a new prompt that says “approved.”
Logging sensitive guardrail input without redaction.

Check your understanding

What is the difference between a guardrail and approval?
Why should approval bind to exact tool arguments?
Where must critical authorization be enforced?

Expert extension

Build an approval repository with proposal hash, actor, role, expiry, decision reason, and one-time consumption. Add tamper, replay, expiry, and stale-resource tests.

Official references

Add Guardrails and Human Approval

How do you pause a tool call?

approval_demo.py:

python

import asyncio

from agents import Agent, Runner, function_tool


@function_tool(needs_approval=True)
async def apply_ticket_label(ticket_id: str, label: str) -> str:
    """Apply an approved label to a ticket. Demo only."""
    return f"Applied {label} to {ticket_id}"


agent = Agent(
    name="Support label assistant",
    instructions="Propose a label when useful. The application handles approval.",
    tools=[apply_ticket_label],
)


async def main() -> None:
    result = await Runner.run(agent, "Label T-100 as billing-review.")

    if not result.interruptions:
        print(result.final_output)
        return

    state = result.to_state()
    for interruption in result.interruptions:
        # A real application displays exact arguments and verifies the approver.
        state.approve(interruption)

    resumed = await Runner.run(agent, state)
    print(resumed.final_output)


if __name__ == "__main__":
    asyncio.run(main())

Never auto-approve in production as the example does. Store the state, show the exact proposed action and impact to an authorized reviewer, record the decision, then resume.

Where do guardrails run?

Input guardrails evaluate the initial agent input.

Output guardrails evaluate the agent producing final output.

Tool guardrails wrap the function tools to which they are attached.

How do you prove approval is real?

Test that:

the handler never runs before approval;

rejection resumes with a denied result rather than execution;

only an authorized role can decide;

approval binds to exact arguments and expires;

changed business state invalidates stale approval; and

the same state cannot commit twice.

Failure injection: Approve label=billing-review, then alter the stored proposal to label=resolved. A cryptographic/integrity binding or server-side proposal record must detect the change.