Metadata-Version: 2.4
Name: openai-agentlock
Version: 0.1.0
Summary: AgentLock authorization middleware for the OpenAI Agents SDK.
Author: openai-agentlock contributors
License-Expression: Apache-2.0
License-File: LICENSE
Keywords: agent,agentlock,ai,authorization,openai
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Typing :: Typed
Requires-Python: >=3.10
Requires-Dist: agentlock>=1.2
Requires-Dist: openai-agents>=0.13
Provides-Extra: dev
Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# openai-agentlock

AgentLock authorization middleware for the OpenAI Agents SDK.

Wraps `FunctionTool` instances so every tool call passes through an
`AuthorizationGate` before the tool body runs. Denials are returned to the
model as plain strings; allowed calls receive a single-use execution token,
optional output transforms, and provenance tracking.

## Install

```bash
pip install openai-agentlock
```

## Minimal usage

```python
from agents import Agent, function_tool
from agentlock import AuthorizationGate, AgentLockPermissions
from openai_agentlock import lock_agent

gate = AuthorizationGate()

@function_tool
def read_record(record_id: str) -> str:
    return f"record {record_id}"

agent = Agent(name="demo", tools=[read_record])

lock_agent(
    agent,
    gate,
    permissions={
        "read_record": AgentLockPermissions(
            allowed_roles=["reader"],
            requires_auth=True,
        ),
    },
)
```

Pass an identity object through `RunContextWrapper.context` that exposes
`user_id`, `role`, and (optionally) `session_id` so the gate can evaluate
role and scope.

## License

Apache 2.0.
