OpenAI runtime authorization

The problem with OpenAI tool calls

OpenAI's function calling lets GPT models trigger real actions in your system: send emails, process payments, modify databases, call external APIs. The model decides what to call, generates the arguments, and your code executes it. There is no guardrail step between the model's decision and your code's execution.

OpenAI's Agents SDK includes input and output guardrails, but these operate on the conversation level, not the tool level. They can check whether a user's message is appropriate, but they do not enforce "this specific function call with these specific arguments should be blocked." Enforcement is not a model problem. It is an infrastructure problem.

Before and after Veto

The left tab shows standard OpenAI function calling. The model returns tool_calls, your code executes them unconditionally. The right tab adds Veto. Same agent, same tools, each governed call evaluated against policy first.

import OpenAI from 'openai'

const openai = new OpenAI()

const tools = [
  {
    type: 'function',
    function: {
      name: 'send_email',
      description: 'Send an email',
      parameters: {
        type: 'object',
        properties: {
          to: { type: 'string' },
          subject: { type: 'string' },
          body: { type: 'string' },
        },
        required: ['to', 'subject', 'body'],
      },
    },
  },
  {
    type: 'function',
    function: {
      name: 'process_payment',
      description: 'Process a payment',
      parameters: {
        type: 'object',
        properties: {
          amount: { type: 'number' },
          recipient: { type: 'string' },
        },
        required: ['amount', 'recipient'],
      },
    },
  },
]

const response = await openai.chat.completions.create({
  model: process.env.OPENAI_MODEL!,
  messages: [{ role: 'user', content: userMessage }],
  tools,
})

// GPT says "call process_payment with amount: 50000"
// Your code does it. No policy. No limit. No approval.
const toolCall = response.choices[0].message.tool_calls?.[0]
if (toolCall) {
  const args = JSON.parse(toolCall.function.arguments)
  await executeTool(toolCall.function.name, args)
}

Policy configuration

Define guardrail rules in declarative YAML. Version control alongside your code. Prompt engineering is not the enforcement mechanism. Policies apply at the governed tool boundary, independent of the model response.

rules:
  - name: block_competitor_emails
    description: Block emails to competitor domains
    tool: send_email
    when: args.to.endsWith("@competitor.invalid")
    action: deny
    message: "Cannot send emails to competitor domains"

  - name: approve_large_payments
    description: Require approval for payments over $500
    tool: process_payment
    when: args.amount > 500
    action: require_approval
    approvers: [finance-team]
    timeout: 30m

  - name: block_after_hours_payments
    description: No payments outside business hours
    tool: process_payment
    when: context.time.hour < 9 || context.time.hour > 17
    action: deny
    message: "Payments require business hours (9am-5pm)"

  - name: daily_payment_cap
    description: Cap total daily payments at $10,000
    tool: process_payment
    when: context.daily_total + args.amount > 10000
    action: deny
    message: "Daily payment cap of $10,000 reached"

First governed call

Supported models

Veto works with OpenAI models that emit tool calls through the API. Keep the model compatibility check in CI because provider catalogs change.

What Veto covers for OpenAI agents

Frequently asked questions

Related integrations