OpenAI Agents SDK Starter: Customer Support Desk

A working multi-agent customer-support app on the OpenAI Agents SDK (openai-agents 0.24.0, Python 3.10+), with the parts tutorials skip: guardrails, human approval for refunds, pause-and-resume across processes, session memory, ownership checks and offline tests.

customer -> Triage agent --handoff--> Orders agent  (lookup_order, track_shipment, search_faq, create_ticket)
                         \--handoff--> Billing agent (lookup_order, refund_order*, search_faq, create_ticket)
            * refunds above $50 pause the run until a person approves or rejects

python3 -m venv .venv && . .venv/bin/activate
pip install -r requirements.txt
./demo.sh                                     # offline, no API key
./run_tests.sh                                # offline, no API key

export OPENAI_API_KEY=...                     # then talk to a real model
python -m support_desk chat --email maya@example.com
python -m support_desk ask "Where is my order A1002?" --email maya@example.com

The model is the SDK's default unless you set OPENAI_MODEL. --limit 100 changes the auto-approve refund limit. Demo customers: maya@, leo@ and ana@example.com (orders A1001-A1005).

• Input guardrails run only for the agent a run starts with. If you continue a conversation with the Billing agent, guardrails on the triage agent alone would be skipped. Every agent here has them, and a test checks it.
• The card blocker runs before the model (run_in_parallel=False), so the number is never sent to OpenAI. A test proves the model is never called.
• Approvals fail closed. With a callable needs_approval, the SDK asks a human whenever argument validation changes the input, so a plain float amount makes the model's 20 (an integer) need approval every time. amount is typed int | float and a test covers it.
• Paused runs survive restarts. save_paused() serializes the run with only the safe parts of your context; load_paused() re-attaches your live database in another process.
• Ownership is checked in code. Asking about someone else's order gets nothing, whatever the model is told.
• Refunds are limited in code to delivered orders, the 30-day window and the amount left on the order.

from support_desk.testing import ScriptedModel, call, say
model = ScriptedModel([[call("transfer_to_billing_agent")], [call("lookup_order", order_id="A1001")], [say("Found it!")]])
triage = build_agents(model)   # real Runner, tools, handoffs and guardrails; scripted LLM replies

model.seen records the instructions, input and tools each call received, so you can assert on what the model was shown.

23 tests on Python 3.13 and 3.10 with openai-agents 0.24.0: routing and handoffs, auto and manual refund approval (approve, reject, no approver), serialize-and-resume in a fresh agent graph, ownership checks, refund limits, the integer-amount approval gotcha, all guardrails (including that the model is never called), session memory across SQLiteSession objects, and the CLI. The SDK's runner, tools, handoffs, guardrails, approvals and sessions all run for real; only the LLM is replaced by an offline model.

• Tests don't call a real model (no API key needed). With a real model, answers vary; the code-level checks (ownership, limits, guardrails, approvals) do not.
• DemoModel is a rule-based stand-in for the demo, not a chatbot.
• The prompt-injection blocker is a keyword filter; add the model-based on_topic check or your own for stronger screening.
• The store is a SQLite demo. Connect your real order system before going live.
• Tracing is on by default with a real key (sensitive data excluded); turn it off with set_tracing_disabled(True) if you don't want traces sent to OpenAI.