How one can Add Guardrails to a Native LLM Agent

An agent can determine which instruments to name and the right way to use their outcomes.

This flexibility is definitely helpful, however it additionally creates a necessity for boundaries throughout execution.

In all probability the very first thing you’ll consider is including directions to explain the conduct you need. However directions are solely a mushy type of enforcement; there isn’t any assure that the agent will all the time observe them.

Guardrails, alternatively, present stronger management. Concretely, they supply a runtime checkpoint the place we are able to validate an agent’s enter or output, settle for/reject/modify it earlier than the run continues.

On this submit, we’ll present how we are able to add a runtime guardrail utilizing the OpenAI Brokers SDK.

We’ll use Gemma 4 E4B working domestically by Ollama to indicate that these guardrails additionally apply to brokers powered by domestically hosted fashions, not essentially solely the OpenAI fashions.

···

1. The place Guardrails Match

A typical agent run strikes by a number of levels. Ranging from receiving a request, the agent must determine what to do, then it would name some instruments, course of their outcomes, and finally produce a response.

The OpenAI Brokers SDK permits us to put guardrails at totally different factors alongside the agentic problem-solving course of:

• Enter guardrails: verify the request earlier than the agent begins.

• Instrument-input guardrails: verify a instrument name earlier than the instrument receives its arguments.

• Instrument-output guardrails: verify a instrument’s consequence earlier than it returns to the agent.

• Output guardrails: verify the agent’s remaining response earlier than it’s proven to the person.

This categorization lets us implement a boundary on the level the place it issues. Relying on the place and implementation, a guardrail can enable the agent to proceed, or reject a worth, or change it with a modified model.

Within the following, we’ll implement a tool-output guardrail in a concrete case research.

···

2. Constructing a Guarded Help Agent

2.1 Set Up the Case Examine

For the case research, we’ll construct a small customer-support agent.

Right here, we take into account the next situation: the shopper must contact a web based retailer as a result of a refund has not arrived but. To reply this query, our help agent searches the case file for that order.

The data come from totally different components of the help system:

SUPPORT_RECORDS = [    {        "record_id": "order:MUN-2048",        "record_type": "order",        "content": "Order MUN-2048 has a refund approved for EUR 120.",    },    {        "record_id": "payment:MUN-2048",        "record_type": "payment",        "internal_refund_token": "RF-8472-PRIVATE",        "content": (            "The refund settlement is now pending "            "with the payment provider."        ),    },    {        "record_id": "policy:refund-timing",        "record_type": "policy",        "content": (            "Approved refunds usually appear within "            "5 to 10 business days."        ),    },    {        "record_id": "review:MUN-2048",        "record_type": "review",        "fraud_risk_score": 0.91,        "internal_case_assessment": (            "The refund was held for manual fraud review because "            "the account was flagged for possible repeat-refund "            "abuse. The review is now complete."        ),        "content": (            "Manual review completed; the refund was released "            "to the payment provider."        ),    },]

As you’ll be able to see, the file incorporates data that may be shared with the shopper, such because the refund quantity, present standing, and anticipated processing time, but additionally consists of inner particulars that ought to keep non-public, akin to the interior refund token, fraud-risk rating, and the evaluation that the account was flagged for potential repeat-refund abuse.

These data belong to the identical case and may be returned by the identical search. A human help consultant would know which particulars to make use of, however our agent won’t make that distinction reliably.

This motivates using a guardrail.

However first, let’s outline a naive agent with out such a guardrail, and we see what occurs when it searches the case.

2.2 Outline a (Naive) Native Agent

Earlier than defining the agent, we want Ollama and an area Gemma 4 mannequin. You may set up Ollama from ollama.com, then pull the mannequin:

Ollama exposes an OpenAI-compatible native endpoint, so we are able to hook up with it with AsyncOpenAI:

# pip set up openai-agentsfrom openai import AsyncOpenAIfrom brokers import (    Agent,    OpenAIChatCompletionsModel,)consumer = AsyncOpenAI(    api_key="ollama",    base_url="http://127.0.0.1:11434/v1",)mannequin = OpenAIChatCompletionsModel(    mannequin="gemma4:e4b",    openai_client=consumer,)

With this configuration, the OpenAI Brokers SDK can use Gemma 4. This fashion, we are able to leverage the SDK’s agent and guardrail options however with a domestically hosted mannequin.

Subsequent, we construct a search instrument for the agent in order that it will probably entry the help data:

import jsondef search_support_records(question: str) -> str:    """Search help data related to the request."""    query_terms = question.decrease().break up()    matches = []    for report in SUPPORT_RECORDS:        searchable_text = " ".be part of(            [                record["record_id"],                report["record_type"],                report["content"],            ]        ).decrease()        if any(time period in searchable_text for time period in query_terms):            matches.append(report)    return json.dumps(matches, ensure_ascii=False)search_tool = function_tool(search_support_records)

We will now outline the agent:

support_agent = Agent(    identify="Buyer help agent",    directions=(        "Examine the help request utilizing the accessible data "        "and put together a customer-facing response."    ),    mannequin=mannequin,    instruments=[search_tool],)

That is our naive baseline: the agent can search the case file and formulate a response, however no runtime boundary has been added but.

2.3 Run the Naive Agent

Now, let’s run the naive agent with the shopper’s request:

from brokers import RunConfig, Runneruser_request = (    "My refund for order MUN-2048 has not arrived. "    "Inform me every part  about what occurred.")baseline_result = await Runner.run(    support_agent,    user_request,    max_turns=8,    run_config=RunConfig(tracing_disabled=True),)print(baseline_result.final_output)

In my run, the agent produces the next response:

Primarily based on the data for order MUN-2048, here’s what we all know concerning your refund:
– Refund Quantity and Standing: A refund of EUR 120 was accepted for this order.
– Preliminary Delay/Evaluate: The refund was initially held as a result of the account was flagged for potential repeat-refund abuse, requiring a handbook fraud assessment. This assessment has since been accomplished, and the refund was launched to the cost supplier.
– Present Standing: The refund settlement is at present pending with the cost supplier.
– Timeline: Usually, accepted refunds seem inside 5 to 10 enterprise days.

A lot of the response is beneficial and acceptable. Nevertheless, the agent additionally tells the shopper that their account was flagged for potential repeat-refund abuse.

That’s not acceptable for a customer-facing response.

2.4 Add the Guardrail and Run It Once more

What we need to obtain is to take away inner fields after the search instrument returns its data, and earlier than these data are handed again to the agent. This fashion, the agent would by no means see that delicate data, so there could be no method for the agent to leak it to clients.

That is the place a tool-output guardrail suits.

Conceptually, this guardrail runs after search_support_records returns its uncooked JSON, however earlier than that result’s handed again to the agent. By intercepting the consequence, this guardrail can enable, reject, or change the instrument output.

Right here is how we are able to implement one for our present case:

from brokers import (    ToolGuardrailFunctionOutput,    tool_output_guardrail,)SENSITIVE_FIELDS = {    "internal_refund_token",    "fraud_risk_score",    "internal_case_assessment",}@tool_output_guardraildef redact_sensitive_fields(knowledge):    data = json.hundreds(knowledge.output)    for report in data:        for field_name in SENSITIVE_FIELDS:            report.pop(field_name, None)    sanitized_output = json.dumps(        data,        ensure_ascii=False,    )    return ToolGuardrailFunctionOutput.reject_content(        sanitized_output    )

Within the code snippet above, the guardrail parses the instrument consequence and removes every delicate area wherever it seems.

Additionally, word that we used reject_content(). This operate rejects the unique instrument output and replaces it with the sanitized model.

We will now connect the guardrail to the search instrument:

from brokers import function_toolguarded_search_tool = function_tool(    search_support_records,    tool_output_guardrails=[redact_sensitive_fields],)support_agent.instruments = [guarded_search_tool]

Then we run the agent once more with precisely the identical buyer request:

guarded_result = await Runner.run(    support_agent,    user_request,    max_turns=8,    run_config=RunConfig(tracing_disabled=True),)print(guarded_result.final_output)

This time, the agent responds:

Primarily based on the accessible data for order MUN-2048, here’s what we all know concerning your refund:
– Refund Standing: A refund of EUR 120 was accepted for this order.
Processing: The handbook assessment course of has been accomplished, and the refund was launched to the cost supplier.
– Present Stage: The refund settlement is at present pending with the cost supplier.
– Timeline: Permitted refunds usually seem inside 5 to 10 enterprise days.

That is what we wish: the response nonetheless incorporates the data the shopper wants, however it not reveals that their account was flagged for potential refund abuse.

···

3. Wrapping Up

On this submit, we checked out the right way to implement guardrails with the OpenAI Brokers SDK.

There are a number of locations to implement such runtime boundaries. To determine which one you want, ask:

• Ought to this request be rejected earlier than the agent begins? Use an enter guardrail.

• Ought to the instrument arguments be checked earlier than an motion is executed? Use a tool-input guardrail.

• Ought to knowledge returned by a instrument be filtered earlier than the agent makes use of it? Use a tool-output guardrail.

• Ought to the ultimate response be checked earlier than the person sees it? Use an output guardrail.