Verify scoped Grantex grants before OpenAI Agents SDK tools execute, and add audit recording where required.
Your OpenAI agents operate with full API access. No scoping, no audit trail, no revocation. You can't tell which agent did what or limit what it can do.
Each agent gets a scoped, time-limited JWT. Tools enforce scope checks, optional audit wrappers record calls, and grants remain centrally managed.
pip install grantex-openai-agents — wraps OpenAI agent tools with authorization.
Create an agent identity with scopes matching its capabilities.
Obtain a scoped grant through the application's configured authorization and consent flow.
Configured tool wrappers verify the grant and required scope before executing.
Use the audit wrapper to record tool invocations with agent identity, scopes, and timestamps.
from agents import Agent
from grantex_openai_agents import create_grantex_tool
search = create_grantex_tool(
name='search',
description='Search approved sources',
grant_token=token,
required_scope='search:read',
func=search_tool,
)
email = create_grantex_tool(
name='send_email',
description='Send an approved email',
grant_token=token,
required_scope='email:send',
func=email_tool,
)
agent = Agent(
name='assistant',
tools=[search, email],
)Wrap every protected OpenAI Agents SDK tool and handle verification failures explicitly.
Define which tools each agent can use and with what parameters. Enforced at the protocol level.
Use the audit wrapper to record tool calls with agent identity and scope context.
Parent agents delegate narrower access to sub-agents. Full delegation chain tracking.
Enforce per-agent spending limits in the trusted service before executing a metered action.
Optional audit logging plus SCIM and SSO controls for enterprise identity workflows.
This integration enforces authorization only where its wrapper or middleware is installed. Local JWT verification checks signatures and claims after JWKS retrieval; it does not prove current revocation unless the verifier performs an online state check or synchronizes revocation data.
Token verification does not create a consent record or prove that a tool executed. Use the configured authorization flow for grant decisions and add an audit integration at the execution boundary when action records are required.
Follow the integration guide and verify the package version before deployment. Apache 2.0.