How do guardrails work in the OpenAI Agents SDK and what should they check?

In the OpenAI Agents SDK, guardrails are a concept that separates input, output, and tool guardrails to control agent behavior and mitigate risks. They function as an engineered control layer around an agent system, providing visibility and interruption capabilities for unsafe behavior.

Guardrails should check for the following:

• Input Guardrails should block or triage suspicious requests before the agent processes them or calls tools. This helps mitigate risks like prompt injection (OWASP LLM01) by sanitizing retrieval and validating schemas.
• Output Guardrails inspect the final responses generated by the agent. They can be used to filter sensitive information (OWASP LLM02) and ensure contextual grounding to prevent overreliance on unfaithful answers (OWASP LLM09).
• Tool Guardrails validate function inputs and outputs around every custom tool invocation. For tools with side effects, blocking guardrails should be used before execution, not just after generation. These guardrails are crucial for mitigating risks such as unauthorized tool invocation through role confusion, excessive agency (OWASP LLM08), and identity & privilege abuse (OWASP ASI03). They should also ensure that external content cannot authorize its own follow-up actions.
• Guardrails should also be evaluated for bypass attempts on denied topics, PII exfiltration, injection through retrieved chunks, and hallucination-induced incorrect action arguments. They should also measure grounding and hallucination scores under realistic retrieval noise.
• For high-impact actions, guardrails should incorporate human review before outputs affect production systems or people. This includes actions like sending messages, making purchases, modifying records, deleting data, deploying code, changing permissions, or acting in regulated workflows.