Founding release candidate · OpenAI Agents SDK 0.19.x

AgentSafe

Test whether approval actually gated your FunctionTool execution.

Record six narrow approval-to-execution properties locally, fingerprint exact argument bytes, and fail honestly when evidence is missing.

  1. Instrument
  2. Run
  3. Record
  4. Check

One-time founding price. One organization, internal use, with all 0.x updates included.

AgentSafe is independent software from YY and is not affiliated with or endorsed by OpenAI.

The failure question

Did rejection stop the handler—and did approval come first?

An approval prompt alone does not prove that a tool waited. AgentSafe checks whether a rejected call stayed outside the handler and whether an approved call executed only after the recorded approval, with the same exact argument bytes.

Measured scope

Six checks, stated exactly

AgentSafe turns an agent run into a deterministic event record, then evaluates approval-to-execution invariants against that record. A pass means the required evidence was observed—not that every property of the agent is safe.

  • Rejected calls do not execute

    A rejected call must produce a later resumed synthetic output without a tool execution event.

  • Approval precedes execution

    A gated tool cannot execute before an approval event for that call.

  • Arguments remain identical

    The approved and executed argument fingerprints must match exactly.

  • Execution is unique and bounded

    Each observed call has no more than one execution start and one completion.

  • Call and output correlate

    Each observed execution resolves to exactly one matching tool output.

  • Read-only tools avoid approval

    A tool declared read-only must run without an approval interruption.

Verified release candidate
0.0.1-rc7 · 6 PASS · 0 FAIL · portability gate PASS
Test suite
13 passing tests across the release fixture, bypass, tampering, duplication, and missing-evidence paths
Validated on
Python 3.12 · OpenAI Agents SDK 0.19.1 · Linux CI

Local evidence

Inspect behavior without collecting prompts

Raw tool arguments do not enter the evidence file.

AgentSafe records SHA-256 fingerprints of the exact UTF-8 argument bytes, event ordering, approval disposition, and result correlation. The evidence stays in a local JSON file that can be checked again in CI.

Check a recorded run
agentsafe check evidence.json --gate

Founding package

A small tool you can inspect and keep

  • Installable Python packageWheel and source distribution for the 0.0.1 release candidate.
  • Readable implementationRecorder, OpenAI adapter, audit rules, and CLI source are included.
  • Integration materialQuickstart, portability-gate reference, and a GitHub Actions example.
  • Verifiable downloadThe archive includes SHA-256 checksums for every release artifact.

Boundary

What this release does not claim

Narrow claims make the result useful. If your integration falls outside this boundary, AgentSafe should report that it could not observe the property—not manufacture a pass.

  • A security audit, certification, legal opinion, or proof that a tool is safe
  • Dynamic needs_approval callback decisions in this release
  • Hosted tools, computer or shell tools, apply-patch tools, MCP tools, or custom tool implementations
  • Coverage outside OpenAI Agents SDK 0.19.x FunctionTool workflows

Founding license

$49 once

Internal use by one organization, including 0.x updates. The founding price rewards early adopters while the supported adapter surface is intentionally narrow.

Not a security audit or certification. Dynamic approval callbacks and other tool types are outside this release's measured scope.