Use the OpenAI Agents SDK adapter

from ctrlrun import Control, InterruptApprovalProvider, protect
import ctrlrun_openai_agents as gate
from ctrlrun_openai_agents import AgentsInterrupt, protected_tool

control = Control(
    policy, store,
    approvals=InterruptApprovalProvider(store, AgentsInterrupt()),
    identity=..., authority=...,
)


@protect("stripe.refund", effect="refund:{payment_id}", wait=True, control=control)
def issue_refund(payment_id: str, amount: int) -> str:
    return stripe.Refund.create(payment_intent=payment_id, amount=amount)


async def refund_tool(payment_id: str, amount: int) -> str:
    """Issue a refund for a payment. Amounts are in integer minor units."""
    return issue_refund(payment_id=payment_id, amount=amount)


agent = Agent(name="refunds", tools=[protected_tool(control, "stripe.refund", refund_tool)])

result = await gate.run(agent, "refund txn_1")
if result.interruptions:
    state = result.to_state()
    for item in result.interruptions:
        state.approve(item)          # or state.reject(item)
    result = await gate.run(agent, state)

​

Where the SDK shows through

• The predicate and @protect can disagree. needs_approval sees the raw arguments, not the decorator’s defaults or a resource= declared only there. A wrong yes asks a human about something harmless; a wrong no means the interrupt finds no answer for a call nobody was asked about and refuses it with ApprovalNotAsked, nothing written, the request left pending for ctrlrun approve. In neither direction does an unapproved action execute.
• One answer authorizes one request, for the action the tool gated. A refund’s yes does not authorize a bank.wire raised beside it, and always_approve=True is refused as an answer because it records a decision about the tool, not the call.
• Observe mode: the predicate answers “no approval needed”, because the SDK would not invoke a declined tool and a human’s no would stop what observe mode promises to run.
• Retries: measured on openai-agents 0.22.0 against a remote that commits and then drops the connection, with no effect-level guard, the model retried until the refund had landed three or four times in one run, five runs out of five. Declare an effect=.

​

If it didn’t work

• ApprovalNotAsked: the tool was invoked without the SDK having asked; pass the same resource= to protected_tool, give the tool no defaulted parameters, and route every @protect(wait=True) on this Control through protected_tool.
• The model retries after a refusal: failure_error_function was left at its default; use protected_tool.
• except DuplicateEffect never fires: you called Runner.run; use gate.run or unwrap.

​

Next

• Use the LangGraph adapter: the prevention shape.
• Three ways in.
• The adapter’s README · Get started · Why.