OpenAI Agents SDK

Choose the enforcement point

An optional Rulebook tool or an instruction telling the model to check policy is advisory. The model may choose not to call it. An enforced integration places Rulebook inside the function tool or in a tool input guardrail that always runs before the protected function.

OpenAI tool guardrails apply to custom function tools. Hosted tools and built-in execution tools need their own interception point or a Rulebook gateway on the only network path to the protected service.

• Function tool wrapper: enforced for that function
• Tool input guardrail: enforced for custom function tools
• Rulebook exposed as an optional MCP tool: advisory
• Gateway proxy in front of the destination: enforced for every routed call

Govern a function tool

This pattern makes the compliance check part of the tool implementation. The function body that performs the side effect is unreachable until Rulebook permits the call. The example uses the synchronous Rulebook SDK, so it delegates the blocking check from the async tool.

import asyncio
import os
from agents import Agent, Runner, function_tool
from avery_rulebook import AveryClient

avery = AveryClient(
    os.getenv("AVERY_URL", "http://localhost:7171"),
    api_key=os.environ["AVERY_TOKEN"],
)
guard = avery.gateway.hook(
    caller={"agent": "agt_openai_support"},
    context={"environment": "production"},
)

@function_tool
async def share_customer_record(
    customer_id: str,
    partner_id: str,
) -> str:
    checked = await asyncio.to_thread(
        guard,
        "crm.share_customer_record",
        {"customer_id": customer_id, "partner_id": partner_id},
    )
    return await crm.share_customer_record(**checked["args"])

agent = Agent(
    name="Customer operations",
    instructions="Help support staff complete approved customer workflows.",
    tools=[share_customer_record],
)

result = await Runner.run(
    agent,
    "Share customer C-104 with approved service partner P-22.",
)

Map outcomes without inventing policy

The adapter should only map SDK lifecycle events to Rulebook requests and map Rulebook verdicts back to the agent framework. Keep rule IDs, thresholds, exceptions and business conditions in the published Rulepack.

• allow executes with the checked arguments
• transform executes with the replacement arguments
• deny stops the function and carries the receipt
• require-approval creates an explicit hold
• runtime failure stops the function because the gate fails closed

Production checklist

• Use a least-privilege Rulebook credential for the agent
• Pass a stable agent identity and deployment environment in caller context
• Do not auto-retry a denial
• Preserve receipt IDs in application telemetry
• Test runtime-unreachable, deny, transform and approval cases
• Use a gateway proxy for hosted or built-in tools that cannot run a custom guard