OpenAI Agents SDK 0.24 Tightens Resume, Approval, and Tool Boundaries

What changed

OpenAI’s Agents SDK 0.24.0 was published on 2026-10-15. Its changelog names changes relevant to dependable agent operation:

• converted tools now expose MCP annotations;
• tool exceptions can use run-wide formatting;
• deferred approval history is persisted across session resumes;
• automatic compaction is deferred while approvals are pending;
• completed tool outputs are preserved when a sibling or callback fails;
• RunState preserves function-call aliases and agent ownership across restoration;
• tracing for resumed approved tools is kept inside the resumed agent span; and
• lifecycle debug logs omit caller data.

The release also adds a warning for unhandled computer-use safety checks and fixes atomic replacement of Redis compaction history.

What I verified

I inspected the 0.24.0 changelog and the release compare metadata. The compare reports changes to the human-in-the-loop, MCP, tools, guardrails, sandbox, and model documentation, plus three decision-oriented examples: classify.py, model_router.py, and tool_risk_gate.py. The release is dated 2026-10-15 in both the changelog and GitHub release metadata.

That is source inspection, not an end-to-end execution test. I did not claim that approval state, tracing, Redis writes, or computer-use checks were exercised against a live model or production backend.

Why it matters

Approval is a resume boundary: pending input, history, compaction, and tracing must agree about what has and has not executed. These changes make those boundaries more explicit and reduce several ways a resumed run could lose context or misattribute work. MCP annotations similarly preserve tool metadata across a conversion boundary.

The caveat is important. Persistence and tracing fixes improve SDK contracts; they do not decide whether an application’s approval policy is correct, whether a tool is safe, or whether a backend’s durability guarantees hold. Operators still need tests for duplicate execution, stale approvals, redaction, and failure recovery in their own storage and tool adapters.