Spend limits for OpenAI Agents SDK function tools
The moment an OpenAI Agents SDK function tool can spend money, the prompt is the only thing between the model and your card. sipi.bot adds a real limit.
Guard the spend inside a @function_tool. Return a string decision so the model can reason about a block instead of retrying it.
from agents import Agent, Runner, function_tool
from sipi_guard import evaluate
@function_tool
def buy(amount: float, merchant: str, category: str = "") -> str:
"Spend money with a supplier (USD). A spend firewall decides if it is allowed."
d = evaluate(amount, merchant, category)
if d["decision"] == "BLOCKED":
return f"BLOCKED by spend policy: {d['reason']}. Do not retry."
if d["decision"] == "FLAGGED":
return f"NEEDS HUMAN APPROVAL: {d['reason']}. Not purchased."
return really_buy(amount, merchant)
agent = Agent(name="Procurement agent",
instructions="Always use buy; if it returns BLOCKED or NEEDS HUMAN APPROVAL, stop and report.",
tools=[buy])
result = Runner.run_sync(agent, "Buy $6,200 of GPU time from unknown-gpu.ru")
For belt-and-suspenders, add an SDK output guardrail that calls evaluate() on any proposed spend and trips a tripwire on BLOCKED. The tool-level check is usually enough for v1.
Returning a string beats raising
The Agents SDK feeds the tool return value back to the model. A "BLOCKED: reason" string lets the model reason and stop; raising aborts the run and teaches the model nothing.
Frequently asked
Should I use a function tool or an SDK guardrail?
Start with the function-tool guard — it is the simplest and covers most cases. Add an output guardrail that calls evaluate() as a second layer if you want a hard tripwire independent of tool wiring.
Does sipi.bot support the Runner streaming loop?
Yes. The guard is a synchronous HTTP call inside the tool, so it works with both Runner.run_sync and the async streaming runner.
Is an API key required?
No key is needed for the open free tier. Set SIPI_API_KEY for hosted tiers with a persistent audit log and dashboard.