OpenAI's guardrails don't control costs. Here's the gap.

OpenAI's Agents SDK guardrails check what goes into and out of an agent. They do not cap what the agent spends. To stop a run at a dollar limit, put a budget check at the model call, with one guard per agent function.

Correction, October 1, 2026: The first version of this post showed a guard decorator imported from agentguard47. AgentGuard has no guard decorator, and you import it as agentguard. The code below uses the real BudgetGuard API and runs against AgentGuard 1.4.0.

Open full-size image (opens in new tab)

What do OpenAI's guardrails do?

The guardrails in the Agents SDK are validators. They inspect what goes into and out of your agents at run time. A failed check can trigger a tripwire that stops the run.

• Input guardrails run on the user's input, for the first agent in a run. A tripped check raises InputGuardrailTripwireTriggered.
• Output guardrails run on the final output of the last agent. A tripped check raises OutputGuardrailTripwireTriggered.
• Tool guardrails run before and after a guarded function tool call. They can skip the call, replace its output, or trip. Hosted tools such as WebSearchTool and FileSearchTool do not go through them.

These are behavior controls. They answer one question: did the agent do the right thing? That question matters. It is not the question that decides your bill.

Why don't guardrails stop overspend?

No guardrail type takes a dollar limit. The SDK counts tokens in result.context_wrapper.usage, and Runner.run takes max_turns, which raises MaxTurnsExceeded when a run takes too many turns. A turn limit is not a spend limit. Ten turns on a long context can cost more than fifty short ones.

That is a scope choice, not an oversight. The SDK handles orchestration and behavior checks. Budget enforcement is a different layer.

Here is the gap. Say your pipeline passes every guardrail check. The output is clean and the tool calls are approved. Then a retry loop hits an edge case at 2 AM and makes 400 API calls while nobody watches. Every guardrail passed, and the budget is gone.

How do you add a spend cap?

Put the cap at the model call. Give each agent function its own BudgetGuard, check it before each call, and charge it after.

from openai import OpenAI
from agentguard import BudgetExceeded, BudgetGuard, estimate_cost

client = OpenAI()
MODEL = "gpt-4o-mini"


def ask(guard, prompt):
    guard.check()  # refuse the call once this run's cap is spent
    response = client.responses.create(model=MODEL, input=prompt)
    usage = response.usage
    guard.consume(
        tokens=usage.total_tokens,
        calls=1,
        cost_usd=estimate_cost(MODEL, usage.input_tokens, usage.output_tokens),
    )
    return response.output_text


def run_analyzer(task):
    guard = BudgetGuard(max_cost_usd=2.00)  # 2 dollars per run, hard stop
    risks = ask(guard, f"List the risks in this task: {task}")
    return ask(guard, f"Rank these risks by cost: {risks}")

When the run's total passes 2 dollars, consume raises BudgetExceeded. Once the total reaches the cap, check refuses the next call before it goes out. The call that crosses the line still bills, so set the cap a little under the most you will pay.

Catch the error where you call the agent, and decide what happens next:

def analyze_or_escalate(task):
    try:
        return run_analyzer(task)
    except BudgetExceeded as exc:
        print(f"analyzer stopped: {exc}")
        return None  # send the task to a person

estimate_cost reads the AgentGuard price table. Check that your model is in it. For a model the table does not know, it returns a cost of zero with a warning, and a cap fed zero never trips.

Why one guard per function? You create the guard inside the function, so each run starts with its own ceiling, and one runaway run cannot spend the next run's budget.

Does this work with the Agents SDK?

The guard counts what you charge to it, so it works wherever you can read token usage. With a raw openai client, charge each response as above. With the Agents SDK, read result.context_wrapper.usage after each run and charge the guard with its totals. That stops the next run, not the turn in progress, so keep max_turns low as well.

For the full setup with tracing and patched clients, see AI agent cost control with AgentGuard in Python.

Which layer handles what?

Use OpenAI's guardrails for behavior: input checks, output checks and tool approval.

Use a budget guard for spend: a dollar cap per agent function, a hard stop when a run passes it, and a running total of what each run cost.

They are different layers, not rivals. One asks whether the agent behaved. The other asks whether it stayed in budget. You need both answers. For a real case of the second failure, see Your AI Agent's Retry Loop Is a Cost Bug Waiting to Happen.

How do you install AgentGuard?

pip install agentguard47

Then import it as agentguard, as in from agentguard import BudgetGuard. The package name and the import name differ, so copy both lines as written.

Accompanying prompt

What the prompt does: It finds the agent functions in your code that have behavior checks but no spend cap, and writes a per-run dollar cap for each one.

Copy/paste this prompt:

Copy-ready prompt

Paste the exact block into your coding agent.

No article chrome, no footnotes, no formatting drift.

Copy promptSelect text

Role: You are a reviewer who checks AI agent code for spend limits. Context: [Paste the agent code: the functions that call a model, and any guardrails around them.] [Name the model each function calls.] Task: 1. List each function that calls a model, and the guardrails or checks around it. 2. Mark each function that has no dollar cap on its model calls. 3. For each one, suggest a per-run cap in dollars and say how you chose it. 4. Write the capped version with AgentGuard's BudgetGuard (install: pip install agentguard47; import: from agentguard import BudgetGuard). Output: - A table: function, model, existing checks, cap, reason. - The capped code for each function. Constraints: - Use only APIs that appear in my code or in the AgentGuard version I have installed. - Mark every cost you did not measure as an estimate. - Keep every existing guardrail.

21 lines/864 chars

Ready

This prompt and every other one we publish live in the free prompt library.

Copy the block above.

Put a dollar cap on your first agent function: AgentGuard