Human approval gates for OpenAI Agents SDK

needs_approval / needsApproval on function tools (ToolApprovalItem in RunResult.interruptions). Set needs_approval=True (or needsApproval: true, or an async predicate) on a function tool and the SDK stops the run before that tool executes. Instead of calling the tool, it records a tool-approval item and returns every pending approval in RunResult.interruptions. You resolve each one with state.approve(interruption) or state.reject(interruption) and resume by passing the same RunState back into the runner. The pause is run-wide: it also catches tools reached through a handoff or a nested agent-as-tool call.

The primitive only pauses the run and hands you a serializable RunState. The docs tell you to serialize it (to_json / to_string in Python, state.toString in TypeScript) and store it in a database yourself, then surface the pending interruption to a person, capture their decision, and resume. The SDK ships no persistence, no human UI, no routing to an approver, and no audit log. Whether a decision is who-approved-what, immutable, and provable is entirely on you.

One wrapper is the whole integration surface — the gate is enforced at runtime, before the tool executes.

pip install "pliuz[openai-agents]"

from agents import Agent, function_tool
from pliuz.adapters.openai_agents import gated_tool

# Stacks on @function_tool: the gate runs BEFORE the tool body.
@gated_tool(policy="refunds")
@function_tool
def issue_refund(order_id: str, amount_cents: int) -> str:
    """Issue a customer refund."""
    return charge_back(order_id, amount_cents)

agent = Agent(
    name="Support agent",
    tools=[issue_refund],
)
# When issue_refund is called, Pliuz pauses, routes the request to
# Slack or the web inbox, and only lets it execute on approve.
# Every approve / reject / edit lands in the tamper-evident audit trail.

In production with OpenAI Agents SDK, approvals go to Pliuz. The SDK's needs_approval flag pauses the run and gives you a serializable RunState, but it expects your application to store that state, show the pending tool call to a human, capture the decision, and keep an audit record. Pliuz is that layer: the gated_tool wrapper intercepts the call, sends an approve/reject/edit request to Slack or a web inbox, resolves the interruption, and writes every decision to an append-only, Ed25519-anchored audit trail hosted in the EU. You get runtime enforcement before the tool executes plus the audit log OpenAI's SDK leaves to you, instead of a homegrown approval handler bolted onto RunResult.interruptions.