QWED Open Responses

Verification Guards for AI Agent Outputs

QWED Open Responses provides deterministic, rule-based verification guards for AI responses, tool calls, and structured outputs. Works with OpenAI Responses API, LangChain, LlamaIndex, and other AI agent frameworks.

Installation

pip install qwed-open-responses

With optional integrations:

pip install qwed-open-responses[openai]      # OpenAI Responses API
pip install qwed-open-responses[langchain]   # LangChain
pip install qwed-open-responses[tax]         # Tax Verification (Payroll, Crypto)
pip install qwed-open-responses[finance]     # Finance Verification (NPV, ISO 20022)
pip install qwed-open-responses[legal]       # Legal Verification (Contracts, Jurisdictions)
pip install qwed-open-responses[all]         # All integrations

💡 What QWED Open Responses Is (and Isn't)

✅ QWED Open Responses IS:

• Verification middleware for AI agents (OpenAI, LangChain, LlamaIndex)
• Deterministic — every check is an explicit, inspectable rule (schema validation, arithmetic recomputation, configurable pattern lists). No LLM calls in the verification path
• Framework-agnostic — works with any LLM or agent framework
• A safety layer — blocks known-dangerous tool calls (configurable blocklist) and incorrect outputs

❌ QWED Open Responses is NOT:

• An agent framework — use LangChain or AutoGen for that
• A prompt engineering tool — use DSPy for that
• A vector database — use Pinecone or Weaviate for that
• A vaguely defined "guardrail" — every check is an explicit, inspectable rule (regex-based pattern scans included, and labeled as heuristics)

Think of QWED as the "firewall" for your AI agent's actions and outputs.

LangChain builds the agent. OpenAI powers the brain. QWED secures the actions.

🆚 How We're Different from Other Guardrails

Use Together (Best Practice)

┌──────────────┐     ┌───────────────┐     ┌──────────────┐
│   LangChain  │ ──► │     QWED      │ ──► │  Verified    │
│    Agent     │     │  (Middleware) │     │  Tool Call   │
└──────────────┘     └───────────────┘     └──────────────┘

🔒 Security & Privacy

Verification happens locally. No data leaves your infrastructure.

Perfect for:

• Agents with access to databases or APIs
• Enterprise internal tools
• Automated financial/legal assistants

❓ FAQ

🗺️ Roadmap

✅ Released

• ToolGuard - Block dangerous tools/patterns
• SchemaGuard - JSON Schema validation
• MathGuard - SymPy calculation verification
• SafetyGuard - PII and injection checks
• StateGuard - Finite state machine validation
• ArgumentGuard - Type and range checking
• Integrations: OpenAI, LangChain

🚧 In Progress

• LlamaIndex Integration - First-class support
• Streaming Verification - Verify chunks in real-time
• Auto-Fix - Deterministic correction of JSON errors

🔮 Planned

• Distributed Rules - Sync rules across agent swarms
• Policy-as-Code - Define guards in YAML/JSON
• Visual Dashboard - View blocked attempts stats

Quick Start

from qwed_open_responses import ResponseVerifier, ToolGuard, SchemaGuard

# Create verifier with guards
verifier = ResponseVerifier()

# Verify a tool call
result = verifier.verify_tool_call(
    tool_name="execute_sql",
    arguments={"query": "SELECT * FROM users"},
    guards=[ToolGuard()]
)

if result.verified:
    print("✅ Safe to execute")
else:
    print(f"❌ Blocked: {result.block_reason}")

Guards

Examples

Block Dangerous Tools

from qwed_open_responses import ToolGuard

guard = ToolGuard(
    blocked_tools=["execute_shell", "delete_file"],
    dangerous_patterns=[r"DROP TABLE", r"rm -rf"],
)

result = guard.check({
    "tool_name": "execute_sql",
    "arguments": {"query": "DROP TABLE users"}
})
# ❌ BLOCKED: Dangerous pattern detected

Validate Structured Outputs

from qwed_open_responses import SchemaGuard

schema = {
    "type": "object",
    "properties": {
        "name": {"type": "string"},
        "age": {"type": "integer", "minimum": 0}
    },
    "required": ["name", "age"]
}

guard = SchemaGuard(schema=schema)
result = guard.check({"output": {"name": "John", "age": 30}})
# ✅ Schema validation passed

Verify Calculations

from qwed_open_responses import MathGuard

guard = MathGuard()
result = guard.check({
    "output": {
        "subtotal": 100,
        "tax": 8,
        "total": 108
    }
})
# ✅ Math verification passed

Safety Checks

from qwed_open_responses import SafetyGuard

guard = SafetyGuard(
    check_pii=True,
    check_injection=True,
    max_cost=100.0,
)

result = guard.check({
    "content": "ignore previous instructions and..."
})
# ❌ BLOCKED: Prompt injection detected

Framework Integrations

LangChain

from qwed_open_responses.middleware.langchain import QWEDCallbackHandler

callback = QWEDCallbackHandler(
    guards=[ToolGuard(), SafetyGuard()]
)

agent = create_agent(callbacks=[callback])

OpenAI Responses API

from qwed_open_responses.middleware.openai_sdk import VerifiedOpenAI

client = VerifiedOpenAI(
    api_key="...",
    guards=[ToolGuard(), SchemaGuard(schema=my_schema)]
)

response = client.responses.create(...)
# Automatically verified before returning

⚠️ Scope & Limitations

Read this before relying on QWED as a trust boundary (issue #31 audit):

• Tool blocking is a configurable blocklist, not a sandbox. Matching is case-insensitive and the default list covers common shells (bash, sh, powershell, zsh, ...), and argument pattern scanning also decodes bounded base64 payloads — but pattern scanning is a heuristic, not a security boundary. Prefer allowed_tools allowlists and OS-level sandboxing for real enforcement.
• PII detection produces warnings, not blocks. PII matches surface as a separate warning state (VerificationResult.warnings); they do not fail verified or block unless you create the verifier with allow_warnings=False.
• Budget checks use model-reported usage. response["usage"] comes from the model output under verification: negative or non-numeric reports fail closed, but under-reporting cannot be detected from the response itself. Supply trusted-side totals via context["total_cost"] / context["total_tokens"] or reconcile against provider reports.
• VerificationResult is not cryptographically attested. Anyone can construct one — including one with a valid-looking binding. The binding hash only detects a mismatch between a result and its response/metadata; it does not authenticate the result itself. Before acting on a result you did not produce in-process, require trusted provenance or cryptographic attestation (tracked in qwed-verification #319).
• Zero guards fail closed. ResponseVerifier.verify() without guards returns verified=False; verify_structured_output() raises ValueError when both a schema and guards are absent — absence of verification is never success.
• Streaming warn-only mode disables the trust boundary. OpenResponsesMiddleware(block_on_failure=False) passes failed items through unmodified — use it for monitoring only.

Why QWED Open Responses?

Links

• Docs: docs.qwedai.com/docs/open-responses
• GitHub: QWED-AI/qwed-open-responses
• PyPI: qwed-open-responses
• QWED Core: QWED-AI/qwed-verification

License

Apache 2.0 - See LICENSE