OpenAI Agents SDK

Attach lifecycle enforcement to local FunctionTools used by the official OpenAI Agents SDK.

1. Install

pip install 'quasentra[openai-agents]'

2. Create local tools

Keep each business capability as a named, typed tool. Underscores in tool names become dots in policy actions.

from agents import function_tool

@function_tool
def customer_lookup(customer_id: str) -> str:
    """Read one customer record."""
    return company_database[customer_id]

@function_tool
def customer_delete(customer_id: str) -> str:
    """Permanently delete one customer."""
    del company_database[customer_id]
    return "deleted"

3. Secure the agent

import asyncio
import os
from agents import Agent, Runner
from quasentra import Quasentra

async def main():
    security = Quasentra(api_key=os.environ["QUASENTRA_API_KEY"], base_url=os.environ["QUASENTRA_URL"])
    agent = Agent(
        name="Support", instructions="Resolve customer requests safely.",
        tools=[customer_lookup, customer_delete],
    )
    agent = security.openai_agent(
        agent_id="support-agent", agent=agent,
        permissions={"customer.lookup": "ALLOW", "customer.delete": "DENY"},
    )
    result = await Runner.run(agent, "Look up customer CUST-100")
    print(result.final_output)
    await security.aclose()

asyncio.run(main())

4. Confirm enforcement

1. Start the application once.
2. Open Dashboard → Agents and confirm the agent and tools were discovered.
3. Open Policies and confirm every action has the intended effect.
4. Request an allowed action and confirm the implementation runs.
5. Request a denied action and confirm it appears in Decisions but never reaches the implementation.

Runtime guarantees

• Agent and tool metadata sync idempotently at construction/startup.
• Newly discovered tools receive default-DENY.
• A denied or approval-required tool implementation does not execute.
• Authorization transport exhaustion fails closed.

Security boundary

Hosted tools execute remotely and are rejected by the local adapter because local hooks cannot enforce their execution.

Do not keep another unwrapped path to sensitive functions. For high-impact tools, move credentials and execution into the trusted gateway.