01 / APPROVAL
The user approves an objective
Send the invoice summary to Accounting. That is the real authorization boundary.
Runtime authority for AI agents
The model can be compromised. The action still does not have to happen.
ArgSeal compiles what the user actually approved into host-issued, field-scoped authority. Every protected tool call is checked before execution, so untrusted content cannot quietly change recipients, add attachments, reach unrelated files, or expand permissions.
No extra model call at admission
Protected values resolve after approval
Fail-closed by design
DeterministicHost policy makes the final decision
Field-scopedAuthority is bound to protected arguments
OpaqueSensitive values stay behind host control
Fail-closedUncertainty never becomes permission
The authority gap
Prompt injection wins when model output is mistaken for permission.
A model interprets whatever it reads. A tool executes whatever it receives. What sits between them today is a claim, not a check. ArgSeal fills that gap with host-controlled proof that each protected field is still authorized when the call reaches the execution boundary.
02 / INFLUENCE
Untrusted content changes the proposal
An invoice, webpage, file, or retrieved document tells the model to substitute a recipient or broaden the action.
03 / ENFORCEMENT
ArgSeal demands actual authority
The model can propose any value. The host permits execution only when the protected field carries valid, correctly scoped authority.
How ArgSeal works
Separate intelligence from authority.
The agent remains free to reason and propose. ArgSeal keeps the authority to act outside the model, in host-controlled registries and deterministic policy.
1
Capture approved intent
The host records what the user authorized before untrusted evidence enters the model context.
2
Mint opaque authority handles
Protected values are represented by host-issued references bound to a tool, field, run, issuer, lifetime, and revocation state.
3
Verify before the tool body
ArgSeal validates the protected call at the Agents SDK guardrail boundary. Invalid authority never reaches the protected callback.
4
Resolve only after admission
The sensitive value remains host-controlled until a valid, single-use resolution grant is issued for that exact call.
Three security models
Do not ask the model to prove its own authority.
ArgSeal is designed for the point where model judgment stops and deterministic execution control begins.
Security property
Self-reported
Model auditor
ArgSeal
Final authority decision
Model claim
Host policy after model advice
Deterministic host policy
Added model calls
0
1 or more
0 at admission
Behavior under malformed output
Unsafe or ambiguous
Must fail closed
Not model-dependent
Protected value exposure
Often raw
Often raw to auditor
Opaque until admission
Scope enforcement
Narrative
Probabilistic classification
Tool, field, run, issuer, lifecycle
Developer integration
Put the enforcement boundary where the effect begins.
The current tested integration protects OpenAI Agents SDK custom function tools wrapped with protectTool.
protected-email-tool.ts
const sendEmail = protectTool({
name: "send_email",
protectedFields: ["to"],
execute: async ({ to, subject, body }, context) => {
const recipient = await context.resolve(to);
return context.mockEmailSink.send({ recipient, subject, body });
},
});Defensible proof
Security claims backed by executable evidence.
The current implementation is tested across valid authority, scope violations, lifecycle failures, replay, malformed model output, tracing failures, route failures, and sink failures.
Focused, integration, browser, clean-checkout, removal, redaction, and supply-chain tests in the completed MVP build.
Host-observed outcomes covering security decisions, callback reachability, sink execution, and fail-closed behavior.
ArgSeal admission is deterministic. It does not require another model to approve the protected field.
Counts describe the completed Build Week MVP evidence and may increase as the product evolves. They are not a claim that every possible integration or attack is covered.
Tested support
Precise claims beat magical security language.
Every item below is implemented and covered by tests in the current build. The full support matrix, including every boundary ArgSeal does not claim, is documented on the Security page.
Implemented and tested
- OpenAI Agents SDK custom function tools wrapped with
protectTool - Field-scoped authority for configured protected arguments
- Tool, field, run, issuer, expiration, revocation, and replay enforcement
- Host-only protected value resolution after deterministic admission
- Redacted native security spans and fail-closed runtime paths
- Current tested SDK version:
@openai/agents 0.13.5
Authority lifecycle roadmap
The tool call is the first boundary, not the last.
The following capabilities are planned directions and are not part of the currently supported MVP.
Recall
Revoke tracked descendants of a source later identified as compromised.
Incident Compiler
Turn a blocked action into a portable deterministic regression test.
Mutation Proof
Generate near-valid authority mutations and require zero unexpected executions.
Effect Seal
Verify the exact prepared external effect immediately before commit.
Give the model room to reason. Keep the authority to act.
Run the poisoned-invoice comparison, inspect the deterministic boundary, and see exactly why the protected action executes or stops.