AgentKit Guardrails: How to Ship Safely on OpenAI's New Stack

Guardrails are the part of AgentKit 1.0 that separates teams who ship from teams who get paged at 3 AM. Here is how to use them well.

What Guardrails Actually Are

In AgentKit, a guardrail is a node-level policy that runs before or after any other node. Inputs are validated before they reach a model call. Outputs are validated before they reach the next node. Guardrails are typed, composable, and have first-class fallback semantics — a failed guardrail does not crash the run; it routes to a designated handler.

The built-in guardrails cover the common cases: content moderation (OpenAI's moderation API), PII detection (built-in regex plus an LLM-judge mode), schema validation (JSON Schema), prompt injection detection, and rate limiting. Custom guardrails are Python or TypeScript functions that return a typed verdict.

The Design Pattern

graph LR
  A[User Input] --> B[Input Guardrail]
  B -->|pass| C[LLM Node]
  B -->|fail| F[Fallback Node]
  C --> D[Output Guardrail]
  D -->|pass| E[Tool Node]
  D -->|fail| F

The most common mistake is treating guardrails as binary gates. Better practice: every guardrail has a structured fallback that either escalates to a human, swaps in a safer model, or returns a graceful error to the user.

PII Handling

The PII guardrail is the one most teams care about. AgentKit ships with detectors for: SSN, credit card numbers, email addresses, phone numbers, IP addresses, and a configurable list of custom patterns. The default behavior is "redact and log," which replaces detected PII with placeholders and emits an audit event.

For HIPAA workloads, the PII guardrail is enhanced with PHI patterns (medical record numbers, ICD codes, provider NPIs). This is gated behind the enterprise tier.

Prompt Injection

The prompt injection detector uses a fine-tuned classifier model that runs on every input. False positive rate is around 2.3% on OpenAI's published benchmarks. For production, the recommendation is to combine the classifier with a system-prompt-level instruction and a separate output guardrail that checks for instruction-following deviations.

Custom Guardrails

Custom guardrails are where you encode business rules. Examples we have seen in production:

• Block any output that mentions a competitor by name
• Flag any tool call that would charge more than $100 without explicit confirmation
• Reject any response longer than 500 tokens for a chat surface that has a 1000-character UI limit
• Require that all extracted email addresses match a whitelisted domain pattern

Each is a 20-line function that returns a verdict and an optional message.

Performance Cost

Guardrails add latency. Built-in guardrails average 80-200ms per check. LLM-judge guardrails add 600-1200ms depending on the model. Plan for it. The deploy command will warn you if your graph adds more than 2 seconds of guardrail overhead per request.

When Guardrails Fail Open vs Fail Closed

The default is fail-closed: a failed guardrail routes to the fallback node. This is correct for most workloads. The exception is read-only informational queries where a graceful degraded answer is better than no answer. The guardrail config supports per-node fail-open mode for these cases.

Frequently Asked Questions

Can I use guardrails without deploying to AgentKit hosted? No, the guardrail runtime is part of the hosted platform.

Do guardrails work for streaming responses? Output guardrails buffer the stream up to a configurable threshold before forwarding. This adds latency but is required for accurate validation.

What about international PII like EU NIN or UK NI numbers? Built-in detectors cover EU, UK, Canada, and Australia formats.

How do I test guardrails in CI? AgentKit's evals harness supports adversarial test suites that exercise guardrail paths.

Sources

• https://platform.openai.com/docs/agents/guardrails
• https://openai.com/blog/agentkit-1-0
• https://www.theverge.com/2026/4/10/agentkit-guardrails-deep-dive
• https://techcrunch.com/2026/04/10/openai-agentkit-safety-system

AgentKit Guardrails: How to Ship Safely on OpenAI's New Stack: production view

AgentKit Guardrails: How to Ship Safely on OpenAI's New Stack is also a cost-per-conversation problem hiding in plain sight. Once you instrument tokens-in, tokens-out, tool calls, ASR seconds, and TTS seconds against booked-revenue per call, the right tradeoff between Realtime API and an async ASR + LLM + TTS pipeline becomes obvious — and it's almost never the same answer for healthcare as it is for salons.

Shipping the agent to production

Production AI agents live or die on three loops: evals, retries, and handoff state. CallSphere runs 37 agents across 6 verticals, each with its own eval suite — synthetic call transcripts replayed nightly with assertion checks on extracted entities (date, time, party size, insurance, address). Without that loop, prompt regressions ship silently and you only find out when bookings drop.

Structured tools beat free-form text every time. Our 90+ function tools all enforce JSON schemas validated server-side; if the model hallucinates an integer where a string is required, we retry with a corrective system message before falling back to a deterministic path. For long-running flows, we treat agent handoffs as a state machine — booking → confirmation → SMS — so context survives turn boundaries.

The Realtime API vs. async decision usually comes down to "is the user holding the phone right now?" If yes, Realtime; if no (callback queue, after-hours voicemail), async wins on cost-per-conversation, which we track per agent in 115+ database tables spanning all 6 verticals.

FAQ

How does this apply to a CallSphere pilot specifically? Setup runs 24 hours, the trial is 7 days with no credit card, and pricing tiers are $49, $99, and $149 — so a vertical-specific pilot is a same-week decision, not a quarterly project. For a topic like "AgentKit Guardrails: How to Ship Safely on OpenAI's New Stack", that means you're not starting from scratch — you're configuring an agent template that's already been hardened across thousands of conversations.

What does the typical first-week implementation look like? Day one is integration mapping (scheduler, CRM, messaging) and prompt tuning against your top 20 real call transcripts. Day two through five is shadow-mode running, where the agent transcribes and recommends but a human still answers, so you can compare side-by-side. Go-live is the moment your eval pass-rate clears your internal bar.

Where does this break down at scale? The honest answer: it scales until your tool catalog gets stale. The agent is only as good as the integrations it can actually call, so the operational discipline is keeping schemas, webhooks, and fallback paths green. The platform handles the rest — observability, retries, multi-region routing — without your team owning the GPU layer.

Talk to us

Explore a live demo and compare current plans to find the right fit for your business.