Guardrails are validation checkpoints that intercept an agent's input or output; InputGuardrail runs before or alongside agent execution and can block the run, while OutputGuardrail validates the final result and raises a distinct exception if checks fail. Both guardrail types accept sync or async functions that inspect data and return a GuardrailFunctionOutput signaling whether a tripwire was triggered, with optional diagnostic metadata attached.
Guardrails are implemented in src/agents/guardrail.py as two types: InputGuardrail, which checks incoming input, and OutputGuardrail, which checks the final agent output.[1]
InputGuardrail accepts a run_in_parallel flag (default True): when True the guardrail runs concurrently with the agent; when False it runs before the agent starts.[1] When GuardrailFunctionOutput.tripwire_triggered is True for an InputGuardrail, the agent's execution immediately stops and an InputGuardrailTripwireTriggered exception is raised.[1] When GuardrailFunctionOutput.tripwire_triggered is True for an OutputGuardrail, an OutputGuardrailTripwireTriggered exception is raised — distinct from the input-guardrail exception.[1]
InputGuardrail.guardrail_function in src/agents/guardrail.py receives (RunContextWrapper[TContext], Agent[Any], str | list[TResponseInputItem]) and must return a GuardrailFunctionOutput or an awaitable of one.[1] OutputGuardrail.guardrail_function in src/agents/guardrail.py receives (RunContextWrapper[TContext], Agent[Any], Any) — where the third argument is the final agent output — and must return a GuardrailFunctionOutput or an awaitable of one.[1] GuardrailFunctionOutput.output_info is an arbitrary Any value the guardrail can populate with granular diagnostic information about the checks it performed.[1]
The @input_guardrail decorator in src/agents/guardrail.py can be applied directly to a function or called with keyword arguments name and run_in_parallel; both sync and async functions are accepted.[1] The @output_guardrail decorator in src/agents/guardrail.py can be applied directly to a function or called with a name keyword argument; both sync and async functions are accepted.[1]
InputGuardrail.get_name() and OutputGuardrail.get_name() in src/agents/guardrail.py return self.name when set, otherwise fall back to self.guardrail_function.__name__.[1] InputGuardrail.run() and OutputGuardrail.run() in src/agents/guardrail.py raise UserError if guardrail_function is not callable.[1]
Sources