面试题库

Codex 与 OpenAI Agents SDK 高效使用

D4 OpenAI Agents SDK：agents、handoffs、guardrails、sessions、tracing

• guardrail 应该放在输入侧还是输出侧？各自的成本、能拦住什么、拦不住什么？Should guardrails sit on the input side or the output side? What does each cost, what does it catch, and what slips through?

  国内高频海外高频深入#agents-sdk#guardrails#safety

  分析过程 · 先想清楚再作答

  1. 题眼在「拦不住什么」。只说两边都要放而不说各自的漏网情况，就是没在生产里被漏网案例打过脸。
  2. 先给分工：输入侧管「该不该做」——话题越界、明显注入、超出服务范围，越早拦越省；输出侧管「能不能说」——泄露敏感信息、格式不合规、违反业务规则，只有模型说完才能查。
  3. 再说成本：输入护栏与主 Agent 并行跑，警报一响就取消主 Agent 的昂贵运行，所以用便宜小模型做输入护栏是省钱手段；输出护栏必须等主 Agent 跑完，省不了钱，只能防事故。
  4. 漏网情况：输入侧拦不住「问题正常但回答跑偏」；输出侧拦不住「模型已经调了有副作用的工具」——所以有副作用的工具需要第三层，围着每次函数调用跑的工具级护栏。
  5. 补一条 SDK 约束：输入护栏只在链条第一个 Agent 上跑，输出护栏只在产出最终回答的 Agent 上跑，挂错位置等于没挂。
  6. 可预期的追问：护栏最常见的失败模式是什么？太严而不是太松——正则黑名单误拦正常用户；上线前要有正常请求的回归集，误拦率是必看指标。

  How to reason about it · think before answering

  1. The crux is 'what slips through'; saying 'use both' without naming each side's blind spot signals no production incidents survived.
  2. Division of labor: input guardrails decide whether to act at all (off-topic, obvious injection, out of scope) and are cheapest early; output guardrails decide whether the answer may be said (leaks, format, policy) and can only run after generation.
  3. Cost: input guardrails run in parallel with the main agent and cancel its expensive run on a tripwire, so a cheap classifier there saves money; output guardrails wait for the full run and only prevent incidents.
  4. Blind spots: input cannot catch a normal question with a drifting answer; output cannot undo a side-effecting tool already called, hence a third layer of tool-level guardrails around each function call.
  5. Add the SDK constraint: input guardrails run only on the first agent, output guardrails only on the agent producing the final answer; misplaced guardrails never execute.
  6. Expect the follow-up: the common failure mode? Too strict, not too loose; regex blocklists over-block real users, so keep a regression set of legitimate requests and watch the false-block rate.

  答题要点

  • 输入侧管该不该做，越早拦越省；输出侧管能不能说，只能事后查
  • 输入护栏与主 Agent 并行、触发即取消，便宜模型在此省钱；输出护栏省不了钱只防事故
  • 输入侧漏「回答跑偏」，输出侧漏「已调有副作用的工具」，需工具级护栏补第三层
  • 输入护栏只在第一个 Agent 生效；常见失败是太严，需正常请求回归集

  Key points

  • Input side decides whether to act and is cheapest early; output side decides what may be said and only runs afterwards
  • Input guardrails run in parallel and cancel the main run, so cheap models save money there; output guardrails only prevent incidents
  • Input misses drifting answers, output misses side effects already taken; tool-level guardrails add the third layer
  • Input guardrails run only on the first agent; the common failure is over-blocking, so keep a regression set