OpenAI Help: Lockdown Mode — Contained Tool Execution for Safer AI Agents

What it is

OpenAI's new Lockdown Mode is a security layer for AI agents that restricts tool execution to a predefined allowlist. When enabled, models can only call explicitly permitted functions—blocking any attempt to execute unauthorized tools, access external APIs, or perform actions outside the configured scope.

According to Simon Willison's analysis, this addresses a critical gap in agent safety: models with tool access can sometimes interpret ambiguous prompts as permission to call unexpected functions.

Why it matters

AI agents with unrestricted tool access pose real risks. A model might:

• Call payment APIs when asked to "process the order"
• Send emails when summarizing a conversation
• Delete files when asked to "clean up"

Lockdown Mode prevents these by default-deny semantics. Only tools you explicitly allow can execute.

This matters most for:

• Production deployments where agents handle user-facing tasks
• Enterprise environments with sensitive data access
• Multi-tenant systems where prompt injection could cross boundaries

Key features

• Allowlist-based execution: Define exactly which tools the model can call
• Default-deny posture: Any tool not on the list returns an error instead of executing
• Runtime configuration: Change allowed tools per-request without code changes
• Audit logging: Every blocked attempt is logged for security review
• Zero performance overhead: Restrictions apply at the API layer, not model inference

How it compares

Traditional guardrails require custom code and can be bypassed by creative prompts. Lockdown Mode enforces restrictions at the platform level—impossible to bypass from the model side.

Who should use it

1. Platform engineers building AI agent systems with tool access
2. Security teams reviewing AI deployment risk profiles
3. DevOps managing production AI workloads
4. Compliance officers requiring audit trails for AI actions

Enable it whenever your agents have access to tools that could cause side effects—APIs, databases, file systems, or external services.

FAQ

Can Lockdown Mode be bypassed?

No. Restrictions are enforced server-side before any tool executes. Even if a model outputs a tool call, the API rejects it if not allowed.

Does it work with function calling?

Yes. Lockdown Mode integrates with OpenAI's function calling feature. Define your allowed function names in the allowlist, and only those execute.

Is there a performance penalty?

No measurable impact. The allowlist check happens at the API gateway layer, adding sub-millisecond latency.