Guardrails
In short
Guardrails are checks on an AI agent’s input or output. In the OpenAI Agents SDK they can halt a run when a check fails, and a tool guardrail can skip a function call, replace its result, or raise a tripwire1.
- Also called
- AI guardrails, Guardrail checks
- Topic
- AI agents
- Level
- Beginner
In the OpenAI Agents SDK, guardrails do checks and validations of user input and agent output1. They are attached to agents and to function tools, but they do not all run at the same point. Input guardrails run on the first agent’s user input. Output guardrails run on the agent that produces the final output. Tool guardrails run on every guarded function-tool call, with an input check before the tool runs and an output check after it1.
An input guardrail runs in parallel with the agent unless it is set to blocking mode. In parallel mode the model may already have started before the check finishes. In blocking mode the check finishes first, and a tripwire means the agent never starts1. A tripwire raises an exception and halts the run. A tool input guardrail can instead skip the call or replace the output with a message. A tool output guardrail can replace the output or raise a tripwire1. The documentation’s samples include a faster, cheaper model that flags maths-homework requests, and a tool check that rejects arguments containing the text "sk-", which the sample treats as a secret1.
The SDK documents those checks for its own agent runs1. NIST’s AI Risk Management Framework organises AI risk management into four functions: govern, map, measure and manage2. Its generative AI profile tells organisations to review security and safety guardrails regularly, especially when a system is used in new circumstances, including why it was initially assessed as safe to deploy3.
Example
The SDK’s sample is a customer-support agent with an input guardrail. A faster model checks whether the user is asking for help with maths homework. If the check says yes, the tripwire fires and the support run stops1.
Why it matters
A guardrail checks the user input, the final answer, or a tool call, and a failed check can stop the run1. NIST’s generative AI profile says to review security and safety guardrails when a system is used in new circumstances3, inside a framework whose functions are govern, map, measure and manage2.
Questions people ask
What do AI guardrails do?
In the OpenAI Agents SDK they check user input, final output, or a function-tool call. A failed agent check raises a tripwire and halts the run. A tool check can skip the call, replace the output, or raise a tripwire1.
Are guardrails the same as an AI safety policy?
No. In that SDK, a guardrail is a check on input, output or a tool call1. NIST’s AI Risk Management Framework is a wider voluntary process with four functions: govern, map, measure and manage2. Its generative AI profile says to review security and safety guardrails regularly, especially in new circumstances3.
Does a guardrail always run before the model?
No. In the OpenAI Agents SDK, input guardrails run alongside the agent by default, so the model may already have started. In blocking mode the check finishes first, and a tripwire means the agent does not run1.
Related terms
Tools that use it
- OpenAI Apps SDKOpenAI's toolkit for building interactive apps that run inside ChatGPT conversations, based on MCP.
- AgentOpsMonitoring and debugging platform that records what AI agents do, what they cost and where they fail.
- Claude CodeAnthropic's coding agent that reads a codebase, edits files and runs commands from the terminal, IDE or web