A Guardrail Can Hide a Tool Result Without Undoing the Action

OpenAI Agents JS 0.17.0 clarifies a subtle boundary around guardrails, tool-result replay, and retained copies. A guardrail may keep a tool result out of the model’s next replay, but that does not automatically reverse an external side effect that already happened. The application may also keep its own copy of the result.

This is not a vulnerability claim. It is a useful reminder that agent safety has more than one surface.

Three layers need separate controls

An agent application can treat these as three distinct layers:

1. Model-visible content: what enters the next model context or replay.
2. External action: what the tool changes in another system.
3. Retained application state: what the host application stores after the tool call.

A control at the first layer does not automatically protect the other two. If a tool already sent an email, changed a file, created a ticket, or called an external API, hiding its result from the model does not make reality rewind.

Put the strongest boundary before the side effect

For high-risk external writes, the tool boundary should enforce scoped authorization before execution. It should also use idempotency where the target supports it, require confirmation when the consequence justifies it, and retain enough evidence for an independent readback. When a reversible compensation action exists, design and test it before relying on it.

Read-only tools and irreversible writes should not share one broad permission. Neither should every blocked result be treated the same way. A policy may need to decide whether the model, the application, or neither may retain the result, while separately recording that an external action occurred.

A practical audit record therefore needs more than the final transcript. It should capture the authorized target, action identity, execution receipt, external readback, model-visible result state, and application-retention state. Otherwise a clean transcript can hide a messy real-world outcome.

Primary source: https://github.com/openai/openai-agents-js/releases/tag/v0.17.0

Disclosure: I used AI assistance to organize and edit this article, then verified the SDK behavior boundary against the linked primary release.