NFTAuth AgentGuard

Credentials authorize an agent. They do not prove user intent.

One protection path, four focused pieces.

The agent proposes. The device decides. The server verifies.

Wrap the function you control.

AgentGuard is framework-independent. It protects developer-hosted function execution; it does not modify OpenAI-hosted tools without a local execution boundary.

OpenAI Agents SDK

import { Agent, run, tool } from '@openai/agents';
import { z } from 'zod';
import { AgentGuard, AuthorizationDeniedError,
  AuthorizationExpiredError } from '@nftauth/agentguard';

const guard = new AgentGuard({
  apiBase: process.env.NFTA_API_BASE,
  agentId: process.env.NFTA_AGENT_ID,
  agentCredential: process.env.NFTA_AGENT_CREDENTIAL
});

const protectedSend = guard.protect({
  action: 'send_email',
  getUserId: (_args, runContext) => runContext.context.userId,
  buildApprovalPayload: (args) => ({
    recipient: args.to, subject: args.subject, message_preview: args.body
  }),
  execute: (args, runContext) => runContext.context.emailService.send(args)
});

const sendEmail = tool({
  name: 'send_email',
  description: 'Send an email after exact-action approval.',
  parameters: z.object({
    to: z.string().email(), subject: z.string().min(1), body: z.string().min(1)
  }),
  execute: protectedSend
});

const agent = new Agent({ name: 'Personal operations agent', model: 'gpt-5.6',
  instructions: 'Prepare useful actions. Sensitive execution needs approval.',
  tools: [sendEmail] });

const userId = 'enrolled-user@example.com';
const emailService = { send: async (message) => ({ accepted: true, message }) };

try {
  const result = await run(agent, 'Tell my manager I am 15 minutes late.', {
    context: { userId, emailService }
  });
  console.log(result.finalOutput);
} catch (error) {
  if (error instanceof AuthorizationDeniedError ||
      error instanceof AuthorizationExpiredError) {
    console.log('The sensitive tool did not execute.');
  } else throw error;
}

Responses API function loop

import OpenAI from 'openai';
import { AgentGuard } from '@nftauth/agentguard';

const openai = new OpenAI();
const guard = new AgentGuard({ apiBase: process.env.NFTA_API_BASE,
  agentId: process.env.NFTA_AGENT_ID,
  agentCredential: process.env.NFTA_AGENT_CREDENTIAL });

const transfer = guard.protect({
  action: 'transfer_money',
  getUserId: (_args, ctx) => ctx.userId,
  buildApprovalPayload: ({ recipient, amount, memo }) =>
    ({ recipient, amount, memo }),
  execute: (args, ctx) => ctx.payments.transfer(args)
});
const context = { userId: 'enrolled-user@example.com',
  payments: { transfer: async (input) => ({ completed: true, input }) } };

const tools = [{ type: 'function', name: 'transfer_money', strict: true,
  description: 'Transfer money after NFTAuth approval.',
  parameters: { type: 'object', properties: {
    recipient: { type: 'string' }, amount: { type: 'string' },
    memo: { type: 'string' }
  }, required: ['recipient', 'amount', 'memo'], additionalProperties: false }
}];
let response = await openai.responses.create({
  model: 'gpt-5.6', input: 'Transfer $250 to Alex.', tools
});
const outputs = [];
for (const item of response.output) {
  if (item.type !== 'function_call') continue;
  const result = await transfer(JSON.parse(item.arguments), context,
    { toolCall: { callId: item.call_id } });
  outputs.push({ type: 'function_call_output', call_id: item.call_id,
    output: JSON.stringify(result) });
}
if (outputs.length) response = await openai.responses.create({
  model: 'gpt-5.6', previous_response_id: response.id, input: outputs, tools
});
console.log(response.output_text);

The developer decides what must stop.

The phone does not decide developer policy, and the SDK protects only explicitly wrapped functions. Read-only research normally does not require approval. Spend, transfer, send, delete, deploy, disclose, publish, permission, and external-modification functions normally do.

const { SENSITIVE_ACTION_POLICY, requiresAgentGuard } =
  require('@nftauth/agentguard/policy');

// Included policy groups: purchases, transfers, emailAndMessaging,
// deletion, productionDeployment, sensitiveFileSharing,
// permissionChanges, publicPosting, calendarModifications.
if (requiresAgentGuard(actionName, SENSITIVE_ACTION_POLICY)) {
  execute = guard.protect(protectedToolConfiguration);
}

The Sandbox policy controls demonstrate this same developer choice visually.

Route an exact action to its enrolled user.

Mobile application walkthrough

Registration and credential setup

Incoming action review

Unlock and decision

Recovery and security settings

The exact endpoints used by the SDK.

{
  "schema": "nftauth.agent-action.v1",
  "agent_id": "agent_example",
  "user_id": "enrolled-user@example.com",
  "run_id": "run_123",
  "tool_call": { "id": "call_123", "name": "purchase", "version": "1",
    "arguments": { "product": "Example", "merchant": "Example Shop", "total": "99.00" } }
}

{
  "success": true, "message": "Awaiting NFTAuth approval.",
  "request_id": "aar_…", "status": "pending", "payload_hash": "sha256:…",
  "agent_id": "agent_example", "user_id": "enrolled-user@example.com",
  "run_id": "run_123", "tool_call_id": "call_123", "tool_name": "purchase",
  "created_at": "2026-07-21T12:00:00.000Z",
  "expires_at": "2026-07-21T12:02:00.000Z", "delivery_status": "sent",
  "resume_handle": "returned only to the trusted agent server",
  "idempotent_replay": false
}

{
  "success": true, "request_id": "aar_…",
  "status": "pending | approved | denied | expired", "payload_hash": "sha256:…",
  "agent_id": "agent_example", "user_id": "enrolled-user@example.com",
  "run_id": "run_123", "tool_call_id": "call_123", "tool_name": "purchase",
  "created_at": "2026-07-21T12:00:00.000Z",
  "expires_at": "2026-07-21T12:02:00.000Z", "delivery_status": "sent"
}

Common failures include 401 invalid agent credential, 400 malformed strict action (including a payload over the module's 64 KiB limit), 403 agent identity mismatch, 404 unknown or inaccessible request, 409 enrollment/idempotency conflict, 410 expiry, 429 rate limiting, and fail-closed 503 dependency errors. Denial is terminal status denied.

Small surface, explicit outcomes.

Typed errors

All extend AgentGuardError: AgentGuardConfigurationError, AuthorizationDeniedError, AuthorizationExpiredError, AuthorizationUnavailableError, PayloadMismatchError, AuthorizationReplayError, InvalidApiResponseError, AuthorizationTimeoutError, and AgentGuardRateLimitError. Safe properties include code, and when applicable status, requestId, and retryAfter.

Approval is verified, not inferred.

Execution is claimed once before the callback. The existing Redis-backed agent-run path provides distributed execution locking; SDK users running multiple Node processes must provide an atomic shared executionStore. Isolated sandbox state never grants production approval.

Threat demonstrations

Open the Sandbox to attempt payload tampering, consumed-approval replay, forced expiration, denial, policy bypass for intentionally non-sensitive actions, and cross-session access.

From working authorization platform to reusable agent protection.

Build Week produced the GPT-5.6 agent orchestration, agent authorization bridge, strict agent action schema, device-bound action approval integration, agent-run lifecycle, exactly-once execution controls, sandbox, reusable AgentGuard SDK, and this developer documentation. The underlying NFTAuth platform, deployed contract, identity work, mobile foundations, and patent predate Build Week.