Stop Risky AI Agent Tool Calls in Python with @harness

The support assistant in this guide has three tools: look_up_order, issue_refund and delete_all_orders. The model chooses which to call and with what arguments. Run it with no check and the recorded run shows the result: a $5,000 refund on a $120 order goes through, and delete_all_orders leaves 0 of 2 orders. Nothing in the code refuses either call.

@harness wraps the function, so every path that reaches it goes through the check: the agent, a test, a script. Your function body does not change.

1. The agent calls the tool. The wrapper receives the call. The function body has not run.
2. The wrapper asks the gateway. It sends the tool name, which is the function name, with the agent id, the arguments, user and input. This is the pre-check. A call without input is refused.
3. The gateway compares the call with the manifest. The tool must be declared, and an amount must be within the declared max_amount. Otherwise Tool Trust is 0, a hard stop.
4. The gateway records the decision. Allowed and refused calls both leave an event.
5. The function runs or does not. An allowed call runs and its result is sent back for a second event. A refused call raises BlockedError with the reason, and the body never executes.

Why a pre-check and not a log

A log tells you a $5,000 refund happened. A pre-check stops it from happening. The adapters for AutoGen, OpenAI Agents, Claude and MCP check after a step has run, so they can hold back a result but cannot stop the action. @harness and governed_tools check before.

Two rules that decide what is checked

• Only declared tools are limited. An agent with no declared tools is not restricted, so every tool is allowed. Declare the tools first.
• The function name is the tool name. If it does not match a declared tool, the call is refused.

The same decorator, on a small support assistant. It may look up orders and refund up to $100. It may not delete orders, and it may not refund $5,000. No model is required: a short script plays the part of the model, so every run is identical. The full program is harness_quickstart.py in the harness decorator docs.

Run it with no pre-check

python harness_quickstart.py --without-agentrust

AgentTrust: off (every tool runs) · agent support-assistant

Customer: "Where is my order O-1001?"
  ran      look_up_order      {'order_id': 'O-1001', 'total': 120}

Customer: "It arrived late. Refund me $40."
  ran      issue_refund       {'order_id': 'O-1001', 'refunded': 40}

Customer: "Refund me $5,000 for the trouble."
  ran      issue_refund       {'order_id': 'O-1001', 'refunded': 5000}

Customer: "Please delete all my orders."
  ran      delete_all_orders  {'deleted': 'all orders'}

Orders left: 0 of 2

Nothing stopped a $5,000 refund on a $120 order, and every order is gone.

Run the same assistant on a local gateway

python harness_quickstart.py --local

The program allows only look_up_order, and issue_refund up to 100. delete_all_orders is not on the list.

AgentTrust: local gateway · agent support-assistant

Customer: "Where is my order O-1001?"
  ran      look_up_order      {'order_id': 'O-1001', 'total': 120}

Customer: "It arrived late. Refund me $40."
  ran      issue_refund       {'order_id': 'O-1001', 'refunded': 40}

Customer: "Refund me $5,000 for the trouble."
  BLOCKED  issue_refund       Tool-trust hard gate: 'issue_refund' amount 5000.0 exceeds declared max_amount 100

Customer: "Please delete all my orders."
  BLOCKED  delete_all_orders  Tool-trust hard gate: action 'delete_all_orders' is not in this agent's declared_tools

Orders left: 2 of 2

The $40 refund ran. The $5,000 refund and the delete were refused before their code ran, so both orders are still there. This output was recorded on 26 October 2026 with agentrust-py 0.0.5. Nothing is kept after the program exits. A --console run against a self-hosted gateway produced the same blocks and kept the events shown below.

Read the approve and block events in the console

Open Events and filter by agent id support-assistant. An allowed call leaves two events, before and after it ran. A refused call leaves one.

You are done when the $5,000 refund and the delete show as Block, and the orders are still there.

Build the longer refund bot, with mock orders and a manifest cap of $1,000, in Guide: Stop Your AI Support Bot from Issuing a Bad Refund.

Put the same check on a framework tool list: LangGraph tool edge and CrewAI agent tools.