Allow low-risk tool calls and block risky calls using OpenAI Decisions.
Intercepts explicitly configured tools immediately before execution and asks a
Predicate question for the probability that each call is risky or
insufficiently authorized. Calls below 0.5 execute normally. Other calls return
an error ToolMessage without invoking the tool. Tools not listed in tools
bypass classification.
The model receives the proposed tool call and up to 30 recent messages. Base64 images are included; audio, video, and file content, which the Decisions API does not accept, are replaced by placeholders. If a request with images is rejected (HTTP 400 or 413), the call is classified once more with images replaced by placeholders. Only explicit user messages authorize execution.
The middleware fails closed: refusals block the call, and classification errors propagate without executing the tool. It blocks risky calls; it does not request human approval.
This middleware is experimental. Its API may change without notice.
from langchain.agents import create_agent
from langchain_openai.middleware import OpenAIAutoModeMiddleware
auto_mode = OpenAIAutoModeMiddleware(
tools=[delete_file],
model="gpt-6-luna",
)
agent = create_agent(
"openai:gpt-6-luna",
tools=[read_file, delete_file],
middleware=[auto_mode],
)Risk question sent to the Decisions API. Describe what should count as risky and safe here.