Payment guardrails for the OpenAI Agents SDK

Where the check goes

The SDK has a guardrail concept, and a payment check is a natural fit for it: the guardrail runs, the tripwire fires, the run halts. Use a guardrail when you want the run to stop outright on a deny, and a wrapped function tool when you want the model to see the refusal and re-plan inside its budget.

Setup

from agents import function_tool
import os, requests


@function_tool
def pay(merchant_id: str, amount_minor: int, rail: str = "x402") -> str:
    """Pay a merchant after checking the spend policy."""
    r = requests.post(
        "https://spend7.com/api/v1/risk-check",
        headers={"Authorization": f"Bearer {os.environ['SPEND7_API_KEY']}"},
        json={
            "intent": {
                "agentId": "assistant-main",
                "amountMinor": amount_minor,
                "currency": "USD",
                "merchantId": merchant_id,
                "rail": rail,
            }
        },
        timeout=5,
    )
    v = r.json()

    if v["decision"] == "deny":
        return f"Refused: {v['summary']} ({v['recommendedAction']})"
    if v["decision"] == "flag":
        return f"Held for approval: {v['summary']}"

    settle(merchant_id, amount_minor)
    return f"Paid. Recorded as {v['paymentId']}."

Questions

Should a payment check be a guardrail or a tool?

A guardrail if a denied payment should end the run; a wrapped function tool if the model should see the refusal and try something cheaper. Most production setups use the tool form, because 'that merchant is not on your allowlist' is information the model can act on, and halting the whole run loses the work it had already done.

Can I use the MCP server instead of calling the API?

Yes. With SPEND7_API_KEY set, the MCP server proxies risk_check to your account so the score uses your stored caps and history. Without a key it still scores locally against a ledger you pass in the call, which is useful for testing a policy before adopting it.