Case study
Course Advisor Agent
An AI agent that can't break the rules
The question
Can an AI course-planning agent explain trade-offs freely while never being trusted on the rules?
A course-planning agent on the OpenAI Agents SDK whose guardrail never trusts the model's own risk claims: it recomputes the policy audit and blocks altered risks, wrong approval flags and blocked-course recommendations.
How it works
- 01
One bounded OpenAI Agents SDK agent with four typed tools: search courses, check prerequisites, evaluate the plan, draft an advisor-approval request.
- 02
Its answer is a Pydantic-validated recommendation, not free prose.
- 03
Deterministic code recomputes prerequisites, term availability, credit load, duplicate enrollment, capstone eligibility and approval needs.
- 04
A named guardrail re-audits the trusted request and blocks altered risks, wrong approval flags, corrupted drafts and blocked-course picks.
- 05
No tool registers for a course, sends a message or changes an external system.
Results
8/8
offline behavior evals pass
4
typed tools
0
side effects — nothing registers or sends
Bottom line
Model proposes, policy disposes: the model can explain trade-offs, but deterministic code has the final word on every recommendation.
What the evals cover
- ✓Clean Winter plan
- ✓ML path after prerequisites
- ✓Missing SQL prerequisite
- ✓Credit overload
- ✓Capstone too early
- ✓Unknown course
- ✓Prompt-injection attempt
- ✓Approval override conflict
Known limits
- —Every catalog entry, student profile and rule is a simplified synthetic fixture — not real McGill policy or data.
- —A coursework prototype, not a production advising system.