GPT-Live-1 in the API: Full-Duplex Voice, Backend Delegation, Interruption Handling, and Production Boundaries

Why GPT-Live-1 matters for API voice systems

OpenAI announced GPT-Live-1 in the API on September 10, 2026, positioning it as a full-duplex voice model for applications that need live speech rather than a slow sequence of record, transcribe, reason, synthesize, and play. The release matters because it formalizes a two-tier production pattern: GPT-Live-1 handles continuous voice interaction at the front end, while deeper reasoning, tool calls, business logic, and durable state remain in a backend model, application service, or agent harness controlled by the developer.

Full duplex means the model can listen and speak at the same time. In a user-facing voice agent, that changes the interaction contract: the system can keep hearing the user during its own speech, detect interruptions, adjust when the user corrects a detail, and avoid forcing every conversation into strict turn-taking. It does not mean the entire application becomes instantaneous, that backend work is cancelled when the user interrupts, or that every spoken correction automatically rewrites a database transaction already in progress.

Delegation means GPT-Live-1 can hand off deeper work to another layer. OpenAI’s Live API documentation separates the live conversation role from the delegated-task role: the voice model manages the spoken exchange, while a backend can reason over larger context, call tools, retrieve records, run policies, or execute application-specific workflows. That separation is not cosmetic; it determines where permissions are checked, where confirmations are stored, where retries are reconciled, and where a team proves that an external action actually happened.

This guide provides a practical end-to-end tutorial for using GPT-Live-1 full-duplex voice mode in real-time ChatGPT conversations. The GPT-Live-1 Complete Guide: How to Use ChatGPT’s Full-Duplex Voice Mode for Real-Time Conversations article is a focused companion for GPT Live Voice Guide because it is the most exact match for a GPT-Live-1 voice guide and complements the current API-focused article with user-facing full-duplex voice usage context.

The release also changes how teams should evaluate voice agents. A demo that sounds natural is no longer enough. A production voice agent must be tested from the user’s spoken intent through transcription, interruption behavior, delegation, tool execution, application state, and the final result communicated back to the user. OpenAI’s cookbook guidance for voice-agent evaluation explicitly separates audio and interaction quality from task quality, which is the right operational boundary for systems that may schedule appointments, look up accounts, modify records, or route support cases.

The official launch claims, with the right caveats

OpenAI’s announcement describes GPT-Live-1 as improving interruption handling, controllable tone, pacing, style, silence handling, background-noise robustness, longer-session reliability, telephony support, ASR transcripts, response text, alphanumeric understanding, keyword biasing, and native turn detection. Those claims are useful for product planners because they identify the target use cases: live assistants, phone agents, education and coaching interfaces, support workflows, and other environments where latency, overlap, and corrections are normal rather than exceptional.

OpenAI also reported a 30-point improvement on its Full Duplex Bench compared with GPT-Realtime-2.1. That benchmark claim should be read as OpenAI’s reported evaluation result, not a guarantee that a particular browser, headset, phone network, backend toolchain, or domain-specific workflow will show the same improvement. Full-duplex quality depends on network conditions, audio hardware, prompt design, session configuration, backend latency, telephony filtering, language, noise, and the user’s speaking behavior.

OpenAI’s announcement says Speak observed almost 80% fewer interruptions during thinking pauses in early evaluations. That customer-reported result is meaningful because thinking pauses are a common failure mode in spoken tutoring and coaching: a voice agent that sounds like it has stopped may invite the user to speak over it, while a voice agent that fills too much silence may annoy the user. The phrase “early evaluations” is the boundary; product teams should treat the result as evidence to investigate, not as a universal service-level objective.

Operational rule: treat launch benchmarks and customer evaluations as input to your test plan, not as substitutes for your test plan. A production team still needs scenario coverage for corrections, missing details, silence, background noise, telephone audio, packet loss, repeated actions, backend failures, and confirmations after verified state changes.

Voice front end versus backend: the architecture boundary

The most important implementation idea in GPT-Live-1 is that the voice layer and backend layer have different jobs. GPT-Live-1 is responsible for the live spoken interface: listening, speaking, turn detection, interruption handling, brief acknowledgments, style control, and deciding when to delegate if configured to do so. The backend is responsible for durable facts: business rules, tool execution, account access, authorization checks, idempotency, confirmations, retries, private records, and final state.

This split protects users and developers from a dangerous assumption: if the assistant says something fluently, the action must have happened. OpenAI’s delegation guidance warns that delegated work and live speech continue independently. A completed backend response does not prove the user heard the result; an acknowledgment appended to a live session does not prove GPT-Live consumed or spoke it; and a spoken confirmation does not prove an external action succeeded. The application must verify state before it tells the user a booking, message, update, payment, deletion, permission change, or other consequential action is complete.

A practical example is a voice support agent that helps a caller reschedule a delivery. GPT-Live-1 can ask clarifying questions, notice that the caller interrupted with a new date, and keep the conversation natural. The backend should check which delivery is eligible, whether the requested date is available, whether the caller is authorized, whether a confirmation is required, and whether a prior retry already changed the delivery. The application should write the change only after the required confirmation and then return verified status to the voice layer for communication.

The same boundary applies to “stop” commands. If a user says “stop talking,” the live layer should stop or reduce speech according to the application’s design. If the user says “cancel my booking,” the backend must evaluate whether there is a booking, whether cancellation is allowed, whether confirmation is required, and whether the cancellation actually completed. Stopping speech is an interaction event; cancelling a booking is a state-changing workflow.

Delegation in plain language: Responses delegation and client delegation

OpenAI documents two delegation patterns for GPT-Live-1: Responses delegation and client delegation. Responses delegation is the managed path in which GPT-Live can call a configured Responses backend. Client delegation gives the application more control: the application receives delegation metadata, builds or selects context, routes work to a model or service, validates or redacts results, and decides what information returns to GPT-Live. The delegation mode is chosen when the session is created, and changing modes requires a new session.

The decision is not just a developer convenience choice. Responses delegation can reduce orchestration work when the application can rely on the configured backend path and does not need extensive pre-return review. Client delegation is the safer fit when a company must control context assembly, keep private tool outputs out of the voice layer, apply custom authorization logic, route to multiple services, redact sensitive data, or reconcile late results across replacement sessions.

This implementation guide explains how to build real-time voice agents using ChatGPT Advanced Voice Mode and GPT-5.5, including WebSocket streaming and production-grade voice interaction concerns. The How to Build Real-Time Voice Agents with ChatGPT’s Advanced Voice Mode and GPT-5.5: Complete Implementation Guide article is a focused companion for Real Time Voice Agents because the marker points to building real-time voice agents, and this target directly covers implementation patterns for production voice agents rather than general voice news.

Developers should treat delegation identifiers as operational correlation data, not as user-facing proof. In Responses delegation, OpenAI’s guide notes that nested response events must retain the outer delegation ID, and completed function calls should be collected from the relevant completion events rather than inferred from empty terminal output snapshots. In client delegation, the application must collect transcripts and maintain task state because delegation events contain metadata rather than a complete task narrative, and transcript fragments can be incomplete or wrong.

Connection choices: browser, server audio, sideband control, and phone systems

OpenAI’s Live API guide describes several connection options. WebRTC is the path for browser applications that need real-time media handling. WebSockets are available for server-side audio use cases. Server-side sideband controls can attach application logic to an existing session. SIP and telephony support address phone integrations where callers are not using a browser or mobile app controlled by the developer. Each option changes where audio is captured, where credentials are protected, how latency is measured, and how the application observes session state.

The quickstart boundary is especially important for browser systems: a trusted server must hold the API key, and the key must not be exposed to the browser. A browser client can participate in media exchange, but production systems should avoid placing long-lived secrets, privileged tokens, private business logic, or direct administrative tool access in client-side code. If a voice agent needs to query or modify business systems, the server-side application should enforce authentication, authorization, approval, logging, and redaction before anything consequential happens.

Recommended production responsibility split:

Browser or phone endpoint:
  - Capture and play audio
  - Display limited user-facing status
  - Do not store API keys or privileged service credentials

Trusted application server:
  - Create and manage sessions
  - Enforce user identity and workspace policy
  - Route delegated work
  - Validate tool arguments and permissions
  - Store durable task state and audit evidence

Backend tools and records:
  - Execute approved reads or writes
  - Return verifiable status
  - Support idempotency and retry reconciliation
  - Expose only the minimum result needed for the user

Telephony use cases deserve separate testing because phone audio introduces filtering, delays, echo, barge-in variation, and caller environments the developer cannot control. A voice agent that performs well through a laptop microphone may behave differently over a mobile carrier connection, a conference bridge, a headset with noise suppression, or a call center transfer. The official product claims include telephony support, but support is not the same as proof that every call path, carrier, codec, or IVR integration will meet a team’s production threshold.

Interruption handling is not cancellation handling

GPT-Live-1’s full-duplex design is intended to improve interruption handling because the model can keep listening while speaking. In user experience terms, that enables more natural barge-in: a user can correct “Tuesday” to “Thursday,” provide a missing account detail, or ask the assistant to pause. In backend terms, however, an interruption is only new input. It does not automatically cancel a delegated task, abort a tool call, roll back a database write, retract an external message, or prove that the user no longer wants the original action.

This distinction should appear in the system design, not just in developer training. The application should maintain explicit task states such as “collecting details,” “awaiting confirmation,” “tool call submitted,” “write verified,” “cancellation requested,” “cancel verified,” and “outcome uncertain.” When the user changes direction, the backend must decide whether the original task can be stopped, whether a submitted tool call needs reconciliation, whether a second action would duplicate the first, and what uncertainty must be communicated to the user.

The conservative rule is simple: do not confirm an external action until verified application state supports the confirmation. If a response was lost, a retry timed out, or a function result is unclear, the assistant should report uncertainty and explain the next safe step rather than creating a duplicate booking, sending a second message, or asserting completion from a natural-sounding generated response.

Prompting GPT-Live-1: keep the live prompt small and honest

OpenAI’s live prompting guidance recommends short prompts because the live model has a small context window. The live prompt should define the role, tone, pace, backchannel policy, interruption policy, actual backend capabilities, concrete delegation conditions, and non-delegation conditions. Detailed procedures, business rules, tool schemas, permission logic, and result handling belong in the backend prompt or application layer, where they can be versioned, tested, and enforced.

A strong live prompt does not pretend the voice layer can do more than the application supports. If the backend cannot change an order, the live model should not say it can. If a human approval is required before sending a message, the live model should tell the user that approval is required. If names, dates, codes, or alphanumeric identifiers are unclear, the model should clarify rather than guess. OpenAI’s documentation notes that prompts do not guarantee exact capture, which means important values still need confirmation and backend validation.

Sample live prompt fragment for a support voice agent:

Role:
You are the live voice interface for a support assistant.

Conversation style:
Speak briefly, at a moderate pace, and acknowledge corrections.

Delegation:
Delegate when the user asks for account-specific status, policy eligibility,
or any action that requires backend records.

Do not delegate:
Do not delegate general availability questions that can be answered without
private records or tool access.

Safety boundary:
Do not promise that a booking, cancellation, refund, message, or record update
has completed until the backend returns verified status.

Interruption handling:
If the user interrupts with a correction, acknowledge it and wait for the
backend to reconcile any active task before confirming the outcome.

This sample is a proposed pattern, not an OpenAI-provided universal prompt. Teams should shorten or expand it only after testing reveals a specific need. Overloaded voice prompts can create conflicts, especially if one rule says “never speak while the user is speaking” and another requires brief backchannels during long user turns. The better approach is to start with moderate backchannels, define concrete delegation triggers, and add constraints only when evaluation shows a repeatable failure.

Launch pricing and cost accounting boundaries

OpenAI’s announcement stated launch pricing for the GPT-Live-1 voice layer at $0.05 per minute, with backend model and tool usage billed separately. That number is a launch boundary, not a permanent budgeting guarantee. Teams should check OpenAI’s current pricing before procurement, pilots, or production commitments, and they should model voice-layer minutes separately from backend reasoning, tool calls, storage, telephony, observability, and application infrastructure.

The separate billing boundary reflects the architecture. A short call with no delegation may primarily consume voice-layer minutes. A longer support call that repeatedly delegates to a backend reasoning model, retrieves records, runs tool calls, and waits for confirmations may incur multiple categories of cost. A phone deployment may also have non-OpenAI telephony costs. Cost dashboards should therefore separate session duration, speaking duration, delegation count, backend model usage, tool execution count, failed retries, and completed outcomes.

A practical pilot budget should avoid averaging all calls into one blended assumption too early. Segment scenarios by task type: informational calls, account lookups, actions requiring confirmation, exception handling, and failed or ambiguous backend states. The most expensive call may not be the longest call; it may be the call with repeated delegation, unclear identifiers, authorization failures, retries, or human approval pauses.

The production takeaway for builders

GPT-Live-1 should be evaluated as a voice front end for a governed backend, not as a replacement for application architecture. The release gives developers a stronger primitive for natural spoken interaction, including simultaneous listening and speaking, but it also makes state boundaries more important. When speech and backend work can proceed independently, teams must design explicit rules for cancellation, retry, confirmation, and replacement sessions.

The first implementation milestone should not be “the demo sounds human.” A safer milestone is: the session starts reliably, the user can hear and interrupt the assistant, delegated results are correct, tool permissions are enforced, backend state changes only after required approval, interruptions do not create duplicate actions, and final confirmations match verified state. That is the difference between a compelling voice prototype and a production system a security, compliance, or operations team can responsibly approve.

Architecture choices that determine who owns context, tools, approvals, and state

OpenAI’s GPT-Live documentation describes a two-tier pattern rather than a single autonomous voice agent: GPT-Live handles the continuous spoken conversation, while delegated backend work handles deeper reasoning, tool execution, private business logic, and durable state. That separation is the design point that should drive architecture reviews, because the voice layer can acknowledge, clarify, interrupt, and summarize, but the application remains responsible for permissions, confirmations, business records, retries, and any external effect.

The most important early decision is the delegation mode selected when the session is created. OpenAI’s delegation guide states that Responses delegation and client delegation are different modes, and that the mode is immutable for a running session; changing modes requires a new session. In production terms, delegation mode is not a runtime preference flag to toggle when a call becomes complicated. It is a session-level contract that determines who builds context, who routes work, who inspects results before the live model sees them, and where budget controls must be enforced.

This article explains how to use OpenAI’s Realtime Voice API to build voice-powered AI applications with speech-to-text, text-to-speech, translation, transcription, and scalable real-time interaction capabilities. The How to Use OpenAI’s New Realtime Voice API: Build Voice-Powered AI Applications article is a focused companion for WebRTC Voice Applications because although the excerpt does not explicitly mention WebRTC, it is the strongest application-building match for real-time voice API integration among the allowed candidates.

Session creation is a security boundary, not just a startup step

A GPT-Live session begins with the application creating or configuring a live session through a trusted environment. OpenAI’s live guide emphasizes that browser applications should not expose the API key; a trusted server should hold credentials and create the session or the short-lived client material needed by the front end. Treat this as an identity and policy boundary: the server can attach workspace policy, user identity, rate controls, allowed delegation mode, and connection parameters before any microphone audio reaches the model.

For browser voice applications, WebRTC is the natural connection path because it is designed for low-latency, bidirectional media in the browser. It handles real-time audio transport between the client and the live session, and it fits applications where the user speaks through a web UI. WebRTC does not remove the need for a backend: the trusted server still protects credentials, creates sessions, records application-side task state, enforces approvals, and reconciles delegated results.

For server-side audio systems, WebSockets are the more direct transport. A contact-center server, device gateway, QA harness, or recording pipeline can stream audio over a WebSocket connection without relying on browser WebRTC APIs. The architectural tradeoff is that the server now sits directly in the audio path, so operational teams must monitor audio buffering, reconnection, usage accounting, and whether a failed socket leaves delegated backend work still running.

Sideband controls let a server control or observe an existing live session from outside the user’s direct media connection. This matters when the browser or phone endpoint should carry audio while a trusted backend appends instructions, supplies delegated context, manages tool results, or performs policy checks. Sideband control should be treated as privileged control-plane access: it can steer what the live model is told, but it must not become a shortcut for inserting secrets, bypassing approval, or pretending that an external action succeeded.

SIP support addresses phone integrations where callers arrive through telephony infrastructure rather than a browser app. SIP makes GPT-Live relevant to call-center, support-line, and voice-IVR replacement designs, but telephone audio introduces practical evaluation requirements: narrowband filtering, background noise, caller interruptions, echo, call transfer behavior, and regulatory notices where applicable. A design that works in WebRTC testing can still fail under telephone conditions, so SIP deployments need their own call-path tests and evidence.

Responses delegation versus client delegation: the operating comparison

OpenAI’s guides describe Responses delegation as the managed path: GPT-Live can call a configured Responses backend for delegated work. Client delegation gives the application more control: the app receives delegation metadata, constructs the backend task context, routes it to a model, agent harness, service, or workflow, validates the result, and decides what to return to GPT-Live. The difference is not merely convenience; it changes auditability, safety review, fallback design, and how much application code must own the conversation state.

The conservative default for many teams is to prototype with Responses delegation and graduate to client delegation when policy, routing, data minimization, or state reconciliation becomes a real requirement. That recommendation is not about model capability; it is about operational ownership. If the app must know whether a refund was already issued, whether the caller is authorized, whether a prior booking exists, or whether a destination account is correct, those checks belong in application logic with durable records.

What immutable delegation mode changes in deployment planning

Because delegation mode is fixed when the session is created, session creation should be treated as a routing decision. A production service may need separate session factories for a public demo, authenticated support, internal employee helpdesk, and regulated workflows. Each factory can select an allowed connection type, delegation mode, prompt, logging policy, and backend routing path before the first user utterance starts a live conversation.

Immutable mode also affects handoff design. If a low-risk browser assistant begins in Responses delegation and the user later asks for a workflow requiring custom approval gates, the application should not pretend it can silently switch the existing session into client delegation. A safer pattern is to explain that a more controlled workflow is needed, create a replacement session with the correct mode, and carry forward only the minimal verified state that the application is allowed to reuse.

Replacement sessions require reconciliation because speech, backend execution, and state can diverge. The application should record whether a delegated task is pending, complete, failed, cancelled, or uncertain before starting a replacement session. If a backend task finishes after the original voice session ends, that late result is not proof that the user heard it, accepted it, or wanted an external action to proceed.

Transcript context is useful, but it is not authoritative state

Client delegation requires the application to maintain task context because the delegation event contains metadata rather than the full task text. The application must collect transcripts and conversation state, but OpenAI’s delegation guide warns that transcript fragments can be incomplete or wrong. This warning is especially important for alphanumeric identifiers, names, addresses, dates, and amounts, where a plausible transcript can still be operationally incorrect.

A robust voice application should separate transcript text from verified facts. For example, the transcript may contain “change my appointment to Friday at four,” while the verified task state should include the user identity, eligible appointments, time zone, available slots, confirmation status, and whether the change has actually been written. The live model can help clarify the spoken intent, but the application should not make a durable change until required details are verified and the user has approved the consequential action.

Transcript context also needs freshness control. If a user says “use the same address as last time,” the application should determine whether reuse is allowed, whether the prior value is current enough, and whether the user must confirm it. OpenAI’s prompting guidance warns that reusing prior results requires application-level freshness and deduplication checks; a live prompt cannot guarantee that stale or duplicate state will be handled correctly.

Delegation IDs are correlation handles, not business records

OpenAI’s delegation guide states that full delegation IDs should be treated as opaque. In practical terms, developers should store them as correlation identifiers for events and appends, not parse them, shorten them, embed meaning into them, or treat their format as stable. The application’s business identifiers—order IDs, case IDs, appointment IDs, approval IDs, idempotency keys, and audit record IDs—should remain separate and should be generated or validated by the application’s own systems.

Opaque delegation IDs matter because delegated work and live speech can proceed independently. A delegation ID can help associate a backend result with the live session context that requested it, but it does not prove that the result was spoken, heard, understood, accepted, or externally completed. Application logs should therefore track at least four different facts: the delegation was requested, the backend work produced a result, the application appended or returned material to GPT-Live, and the external system state was verified if an action occurred.

The append channels described by OpenAI also require careful use. session.instructions.append steers the live model, session.thinking.append supplies internal-use context, and session.commentary.append supplies facts intended to be spoken. These appends are limited and require a delegation ID or null, according to the delegation guide. Quiet context is not a private vault for secrets; do not append credentials, raw protected records, unnecessary personal data, or privileged internal notes simply because the content is not intended to be spoken.

Nested response events require exact event correlation

Responses delegation introduces a nested event pattern that can surprise teams expecting a single terminal result. OpenAI’s delegation guide says nested response events must retain the outer delegation ID. That means a production event handler should preserve the association between the live delegation and the backend response lifecycle rather than flattening events into a generic stream where correlation can be lost.

The same guide warns that completed function calls should be collected from response.output_item.done, and that empty terminal output snapshots do not prove there are no pending calls. This is an operationally important detail: if a backend function call is required, the application should not assume that an empty-looking final snapshot means no tool work remains. It should track function-call completion explicitly and submit every required function result before explicit continuation.

Appending a function result also does not automatically continue the response, according to OpenAI’s delegation guidance. A safe implementation should model the backend lifecycle as a state machine rather than as a loose set of callbacks. The application should know when it is waiting for a tool result, when all required results have been submitted, when continuation is requested, when the final backend answer is available, and when that answer has been reviewed for what the live model may say.

{
  "recommendation": "Track delegated work as application state, not just streamed events.",
  "states": [
    "delegation_requested",
    "backend_started",
    "tool_call_pending",
    "tool_result_submitted",
    "backend_result_ready",
    "result_reviewed",
    "live_context_appended",
    "external_state_verified",
    "user_notified_or_uncertain"
  ],
  "warning": "A spoken acknowledgment, an appended result, or a closed session is not proof that an external action succeeded."
}

Routing and approvals belong outside the spoken layer

Client delegation is the stronger fit when the application must route based on authorization, policy, or data classification. A consumer support call may route to a CRM lookup, a billing policy service, a human supervisor, or a fraud review queue depending on the verified user and request type. GPT-Live can maintain a natural conversation during that process, but the application should decide what is allowed to happen and what information can be returned to the voice model.

Approvals should be explicit application events, not inferred from conversational politeness. “Yes, that sounds good” may be enough to continue a harmless explanation, but it is not automatically sufficient for a payment, message send, cancellation, permission change, contract publication, medical instruction, HR action, or legal filing. For consequential operations, the application should present the exact action, destination, material terms, and known risks, then record affirmative approval before executing the external write.

OpenAI’s prompting guide draws a crucial distinction between “Stop talking” and “Cancel my booking.” The first is an instruction about the live speech behavior; the second is a task change that the backend must process and verify. A user interruption can stop or alter what the model says next, but it does not automatically cancel backend work already in progress. The application must block, cancel, compensate, or reconcile backend actions through its own state machine.

Fallbacks should assume ambiguity, duplication risk, and late results

Voice systems fail in ways that text-only systems often hide: the user may interrupt during a delegated task, a phone call may drop, packet loss may obscure a confirmation, a backend tool may time out after performing the write, or a replacement session may start before the original task reports completion. In all of those cases, the safe fallback is to verify state before retrying. OpenAI’s delegation guide specifically warns that before retrying a failed tool call, the application should verify whether the original action occurred.

Idempotency is therefore a core voice-agent requirement, not an optimization. For actions such as bookings, refunds, ticket updates, outbound messages, and permission changes, generate an application-level idempotency key before the write and store the intended operation. If the connection fails after submission, query the system of record before attempting the operation again. If the outcome remains unclear, tell the user the status is uncertain and provide the next verification step rather than claiming success.

Fallback speech should be honest and bounded. A safe phrase is: “I’m still checking whether that change went through. I won’t try it again until the system confirms the current status.” An unsafe phrase is: “Done,” when the application has only appended a result to the live session or received a natural-sounding backend answer. Generated confirmation is a communication artifact; verified application state is the evidence needed for consequential completion.

Budget controls need to follow the split architecture

OpenAI’s launch materials state that the live voice layer and backend model or tool usage are billed separately, and the announcement included launch pricing for the voice layer while directing developers to current pricing for up-to-date costs. Architecturally, separate billing means separate budgets. A long silence while delegated reasoning runs may be a voice-session cost, a backend-model cost, a tool cost, and a human-review cost at the same time.

Budget enforcement should start at session creation and continue through delegation. The application can cap live session duration, restrict which workflows are available by tenant or user role, limit repeated delegations for the same unresolved task, and route high-cost operations to a written workflow or human queue. For client delegation, budget metadata can travel with the application’s task state so that retries, replacement sessions, and late results do not escape cost accounting.

Do not use a single “call completed” metric as the financial control. A call could be short but trigger an expensive backend investigation, or a long call could remain mostly conversational with no delegated tool use. Finance, platform, and product teams should review voice minutes, delegation count, backend duration or token usage where available, tool invocation count, approval wait time, retry rate, and unresolved-task rate as separate operational signals.

A practical architecture checklist before choosing a mode

1. Define the session entry point. Decide whether the user reaches GPT-Live through browser WebRTC, server-side WebSockets, sideband-controlled media, or SIP telephony, and document which trusted server creates the session.
2. Select delegation mode before launch. Use Responses delegation for a managed backend path when context and routing are simple; use client delegation when the application must own context assembly, review, routing, policy, or reconciliation.
3. Keep business state out of the transcript. Store verified facts, approvals, idempotency keys, system-of-record status, and pending backend work in application state rather than relying on transcript fragments.
4. Treat delegation IDs as opaque. Use them to correlate live and backend events, but keep business identifiers and audit records separate.
5. Implement explicit approval gates. Require human approval for external messages, writes, payments, destructive actions, permission changes, publication, and other consequential operations.
6. Reconcile before retrying. When a tool call times out or a session drops, verify whether the original action occurred before attempting another write.
7. Track nested response events correctly. Preserve the outer delegation ID, collect completed function calls from the documented completion event, submit required results, and explicitly continue when the backend lifecycle requires it.
8. Separate cost ledgers. Track voice-layer usage, backend usage, tool usage, retries, and human-review load independently so that budgets match the two-tier architecture.

Operational rule: GPT-Live can make a voice interaction feel continuous, but continuity is not authority. The application must still decide what can be done, verify what actually happened, and communicate uncertainty when state cannot be confirmed.

State is the product: interruptions, tools, and truthful spoken updates

A full-duplex voice interface changes the user experience, but it does not change the underlying control problem: the application must know what work is pending, what work has already happened, what work was merely discussed, and what has been verified in a system of record. OpenAI’s GPT-Live delegation guidance draws a hard boundary between live speech and delegated work: GPT-Live can speak, listen, and receive appended context, but the application owns permissions, confirmations, business records, private function execution, and durable task state. That boundary matters most when the user interrupts, corrects themselves, or says “stop.” Stopping speech does not cancel backend work.

Backchannels are the small verbal signals a live agent uses to keep a conversation natural: “mm-hmm,” “got it,” “one moment,” or a short acknowledgement before a longer answer. OpenAI’s live prompting guidance recommends starting with moderate backchannels rather than banning all speech while the user speaks, because a blanket no-speech rule can make a full-duplex system feel brittle. The operational rule is narrower: use backchannels to show presence, not to imply action completion. “I’m checking that” is safer than “I’ve changed it” unless the backend has confirmed the change in verified application state.

Interruption handling is the audible part of the problem. Cancellation handling is the backend part. A caller might interrupt because they heard enough, because they want the assistant to stop talking, because they changed the instruction, or because they want to cancel the underlying transaction. Those are different intents, and the application must distinguish them. “Stop talking” can be handled by the live layer as a speech-control request. “Cancel my booking” is a business request that requires authorization, policy checks, tool execution, and a verified result. Stopping speech does not cancel backend work, and a production system must never rely on the microphone event alone as a rollback mechanism.

Production warning: Treat spoken interruption as a conversational signal, not as proof of business intent. If a tool call, payment, message, booking, file update, or permission change has started, the backend must reconcile it through durable state. A quiet voice channel is not evidence that the external action stopped.

Model the conversation as state transitions, not as a stream of nice-sounding replies

A useful GPT-Live application has at least four separate state tracks. The first is conversation state: what the user said, what the model heard, what the model is currently saying, and what has been interrupted. The second is delegation state: what deeper reasoning or backend work has been requested, which delegation ID correlates to it, and whether late results are still possible. The third is tool state: which private functions or external services were called, with which arguments, under which authorization, and with what outcome. The fourth is business state: the final verified record in the application, provider, database, ticketing system, calendar, repository, or other system of record.

These tracks can diverge. GPT-Live might stop speaking while a backend text model is still reasoning. A tool might complete after the caller has already corrected the request. A user might say “never mind” after the external service accepted the original booking. A delegated result might arrive after a replacement session has begun. OpenAI’s delegation guidance is explicit that live speech and delegated work continue independently, and that appended acknowledgements do not prove GPT-Live consumed or spoke the content. The application therefore needs a reconciliation loop, not only a prompt.

Backchannels should buy time without creating false confirmations

Backchannels are safe when they communicate process rather than outcome. Recommended examples include “I heard the new date,” “I’m checking availability,” or “Let me verify that before I say it’s done.” Risky examples include “That’s booked,” “I cancelled it,” or “The email has been sent” before the application has verified the external state. In a voice system, users often treat fluent speech as commitment. The prompt should therefore instruct GPT-Live to use short acknowledgements during delegation, to avoid guessing names, dates, and alphanumeric strings, and to reserve completion language for verified results.

OpenAI’s live prompting guide recommends keeping GPT-Live prompts short because the live model has a small context window. Put the conversational policy in the live prompt and keep business rules in the backend. For example, the live prompt can say: “Use brief acknowledgements while waiting. If interrupted, stop speaking and listen. Do not claim a booking, cancellation, payment, message, or file change succeeded until the backend provides a verified result.” The backend prompt or application policy should then contain the actual booking rules, permission checks, retry policy, and result schema.

Recommended live prompt fragment:
Role: Live voice front end for a scheduling application.
Backchannels: Use brief acknowledgements such as "I’m checking" or "one moment" during backend work.
Interruption policy: If the user interrupts, stop speaking and listen. Do not treat interruption as backend cancellation.
Completion policy: Say an action is complete only after the application provides verified state.
Clarification policy: Clarify important names, dates, times, and confirmation numbers instead of guessing.

This prompt fragment is intentionally small. It does not include database schemas, provider credentials, retry algorithms, or confidential policy text. Quiet context supplied through mechanisms such as internal-use appends should not be treated as a private place for secrets. A production design should assume that any model-facing context can influence behavior and should avoid sending credentials, sensitive records, or unnecessary privileged information into the live layer.

This Codex research-operations playbook covers concurrent agent sessions, experiment queues, human intervention, and safety pause gates, providing a practical companion for controlling delegated tool calls and delayed results. The The Codex Research Operations Playbook: Concurrent Agent Sessions, Experiment Queues, Human Intervention, and Safety Pause Gates article is a focused companion for Tool Call Safety because the target directly supports bounded tool execution, pause gates, and human intervention without relying on an unrelated model-family implementation.

Corrections require superseding intent, not silent overwrites

Corrections are common in speech: “Actually, make that Friday,” “No, I meant Terminal B,” or “Use my work account, not my personal one.” Transcript fragments can be incomplete or wrong, and OpenAI’s delegation guidance cautions that client-delegation applications must collect transcripts and maintain their own task state. A correction should create a new intent version, not mutate history invisibly. The application should mark the previous intent as superseded, record the correction source, and decide whether any already-started work can be changed, cancelled, or must be reconciled as a late result.

A robust correction flow uses explicit versioning. Version 1 might be “book pickup at 4:00.” Version 2 might be “correct pickup to 4:30.” If no external action has occurred, the backend can proceed with Version 2. If a tool call already created the 4:00 booking, the backend must either modify it through an authorized tool, cancel and recreate it if allowed, or tell the user that the original booking exists and needs confirmation before changes. Stopping speech does not cancel backend work, and neither does a corrected sentence automatically erase a completed tool call.

1. Capture the correction. Store the new user utterance with timestamp, transcript confidence if available, and the active task or delegation correlation.
2. Classify the scope. Decide whether the user changed a field, cancelled the whole task, changed the acting account, or only interrupted speech.
3. Freeze risky actions. If the correction affects a pending write, message, payment, booking, permission, or destructive action, block further execution until reconciled.
4. Check external state. Verify whether any prior action already occurred before retrying or issuing a replacement action.
5. Speak the verified status. Say what is known, what changed, and what still requires approval or verification.

Tool execution must be correlated to delegation state

In Responses delegation, OpenAI’s guidance says nested response events must retain the outer delegation ID, and completed function calls should be collected from response.output_item.done. Empty terminal output snapshots should not be treated as proof that there are no pending calls. This detail is easy to miss in production logging: if the application loses the correlation between the live delegation and the nested backend response, it may submit a tool result to the wrong conversational context or speak an answer after the user has moved on.

The safer pattern is to treat the delegation ID as an opaque correlation handle and maintain a separate task record. The delegation ID should help route appends and continuation events; it should not be the only business identifier. The business record should include user identity as authorized by the application, selected account, requested action, required approvals, idempotency key, tool-call IDs if available, external reference IDs, current status, and the latest verified state. This prevents a voice session from becoming the only source of truth.

Conceptual task-state record:
task_id: internal durable identifier
live_session_id: current live session correlation
delegation_id: opaque delegation correlation, if active
intent_version: 2
requested_action: "change appointment time"
approval_status: "required_before_write"
tool_status: "not_started | pending | succeeded | failed | unknown"
external_record_id: stored only after verified creation or lookup
state_verified_at: timestamp of last authoritative check
spoken_status: "not_told | told_pending | told_success | told_uncertain"
supersedes_task_id: optional prior task to reconcile

This is a proposed implementation pattern, not an OpenAI-required schema. Its purpose is to make the application resilient when speech, delegation, and external tools complete in different orders. A backend can be perfectly correct and still produce the wrong user experience if the spoken layer announces stale work, ignores a correction, or treats an interrupted phrase as authorization.

Function results are not finished until submitted, complete, and continued

OpenAI’s delegation guidance states that every required function result must be submitted before explicit continuation, and that appending a function result does not automatically continue the response. That means a tool pipeline has at least three phases: detect completed function calls, execute or reconcile the tool calls, and submit all required results before continuing the delegated response. A system that submits one result and assumes the model will continue automatically can stall. A system that continues before all required function results are present can produce a partial or misleading answer.

The application should also distinguish function execution from function result submission. A private function may have run successfully, failed, timed out, or returned an unknown outcome. The submitted result should accurately represent that state. If a booking provider returns success and the application verifies the record, the function result can contain the confirmed status and reference suitable for speaking. If the network drops after submission but before the application receives a response, the outcome may be unknown; the correct spoken update is not “done,” but “I need to verify whether that went through before trying again.”

Recommended backend continuation logic:
1. Collect completed function-call requests from the delegated response stream.
2. For each required call, check authorization and approval status.
3. Execute only approved calls, or return a "requires approval" result.
4. If execution fails or times out, verify external state before retrying.
5. Submit a result for every required function call.
6. Explicitly continue the delegated response.
7. Append only verified, speakable facts back to the live session.

Human approval is mandatory for external messages, writes, payments, destructive operations, permission changes, publication, and other consequential actions. A fluent “sure” from the assistant is not approval; approval must be captured through the application’s required mechanism and tied to the specific action, account, destination, and material arguments. The live model should be instructed to ask for approval in plain language, but the backend should enforce the approval gate.

Late results should be reconciled, not ignored or blindly announced

Late results are normal in full-duplex systems. A user can interrupt while a backend model is thinking, correct a parameter while a tool is pending, or hang up before the provider responds. OpenAI’s delegation guidance warns that a completed backend response does not prove the user heard the result. It also says client context, late results, cancellations, retries, and replacement sessions require application-level reconciliation. The application should therefore decide whether a late result is still relevant, superseded, unsafe to speak, or requires follow-up through another approved channel.

A late successful result after a cancellation request is the hardest case. Suppose the user says, “Book the 3 p.m. appointment,” then immediately says, “Stop, don’t book it.” If the backend had not executed the booking, the system can mark the task cancelled. If the booking tool had already succeeded, the system must not pretend the interruption prevented it. The accurate update is: “The booking had already been created before your cancellation reached the backend. I can help cancel it now if you want.” Stopping speech does not cancel backend work, and honest late-result handling is the difference between a recoverable inconvenience and a trust failure.

Retries need duplicate prevention and verified external state

Before retrying a failed tool call, OpenAI’s delegation guidance says to verify whether the original action occurred. This is a core production rule for voice agents because the user may press for speed after an awkward silence: “Just try again.” Retrying without verification can create duplicate bookings, duplicate messages, duplicate tickets, duplicate payments, or duplicate permission changes. The correct retry policy starts with external-state verification, not with another function call.

Use idempotency keys or application-level duplicate detection for every consequential write where the downstream system allows it. When a provider supports a request identifier, reuse it for the same intent version rather than generating a fresh one on retry. When a provider does not support idempotency, the application can still search for a matching recent record before writing again. The duplicate check should use stable fields such as user, destination, requested time, amount, subject, or external reference, while avoiding unnecessary exposure of sensitive content in logs or prompts.

This agent-monitoring tutorial explains stop handling, webhook deduplication, preserved evidence, and state reconciliation after potentially unsafe requests, all of which reinforce idempotent and recoverable delegated actions. The Implement OpenAI Misalignment Monitoring for Agents: Responses API Coverage, 403 Handling, Safety Webhooks, and State Reconciliation article is a focused companion for Idempotent Agent Actions because the target is substantially closer to deduplication and state reconciliation than a generic orchestration overview.

Recommended retry decision rule:
If tool_status is "succeeded":
  Do not retry. Speak the verified result.
If tool_status is "failed_before_external_request":
  Retry only if the user request is still current and approved.
If tool_status is "unknown_after_external_request":
  Verify external state before retrying.
If intent_version is superseded:
  Do not retry the old action. Reconcile or cancel according to policy.
If approval has expired or arguments changed:
  Ask for fresh approval before any consequential write.

The phrase “failed” should be precise in logs and user updates. A validation failure before any external request is different from a timeout after sending a request. A tool exception is different from provider rejection. A disconnected voice session is different from a cancelled backend job. Accurate state labels help the assistant speak truthfully and help operators investigate incidents.

Session replacement must preserve tasks without inheriting unsafe assumptions

Changing delegation mode requires a new session, according to OpenAI’s implementation guidance. Sessions can also be replaced for connection recovery, device changes, telephony transfer, deployment rollout, or policy changes. A replacement session should not wipe the durable task ledger. It should also not blindly inherit stale spoken context. The new session needs a concise, current summary from the application: what is pending, what is verified, what was superseded, what requires approval, and what must not be retried.

In client delegation, the delegation event contains metadata rather than task text, so the application must collect transcripts and maintain task state. That makes session replacement an application concern. If a new live session begins while a prior backend job is pending, the application should either attach the job to the new session with explicit status or keep it quarantined until reconciliation. The assistant should say, “I’m checking the status of the earlier request,” not “We’re starting over,” unless the backend has confirmed no external work occurred.

A replacement-session handoff should be short enough for the live model and concrete enough to prevent unsafe speech. Include only facts intended to steer the conversation. Do not include secrets, raw credentials, or unnecessary personal data. If there is a pending consequential action, the handoff should state that no completion claim may be spoken until verified state is returned.

Proposed replacement-session handoff:
User was discussing a delivery reschedule.
Current intent version: change delivery to Friday afternoon.
Prior intent for Thursday is superseded.
A provider update may have been attempted; outcome is unknown.
Do not retry or confirm completion until the backend verifies provider state.
Ask for approval again if destination, date, account, or action changes.

Accurate spoken updates require a “verified state first” rule

The final user experience should be natural, but the release-quality rule is mechanical: speak completion only after verified application state. OpenAI’s evaluation cookbook emphasizes that a natural spoken confirmation is not evidence that the backend succeeded. A complete evaluation follows one request from spoken intent through delegation, actual tool execution, resulting application state, and the result communicated to the user. The same standard belongs in production operations.

Use three spoken status levels. First, acknowledged: “I heard the change.” This does not imply any backend action. Second, in progress: “I’m checking availability” or “I’m verifying whether that went through.” This tells the user why there may be silence or delay. Third, verified: “Your appointment is now Friday at 3 p.m., confirmed in the scheduling system.” The third level should only be used after the application has authoritative state. If the outcome is unclear, the assistant should say so and provide the next verification step.

• Do not say: “Cancelled” when only speech stopped.
• Do say: “I stopped speaking; I still need to verify whether any backend action is pending.”
• Do not say: “Sent” when the message tool timed out after request submission.
• Do say: “The send request may have gone through. I’m checking the message record before trying again.”
• Do not say: “Booked” when the delegated model recommended a slot but no booking tool succeeded.
• Do say: “That slot appears available from the lookup. I need your approval before booking it.”

The most important operational sentence in this section is worth repeating: stopping speech does not cancel backend work. It does not cancel a tool call, undo an external write, revoke a submitted approval, erase a business record, or prove the user heard a later update. Build the voice experience so GPT-Live can be responsive and interruptible, while the backend remains conservative, stateful, idempotent, and honest about what has actually happened.

Turning CRAWL, WALK, and RUN into a production readiness program

OpenAI’s voice-agent evaluation guide frames full-duplex testing in three stages: CRAWL with synthetic single-turn audio, WALK with saved recordings, and RUN with simulated continuous multi-turn callers. In production terms, those stages should not be treated as a demo ladder; they should become a release gate that follows one spoken intent all the way through interaction behavior, delegation, tool execution, final application state, and the result communicated back to the user.

This engineering-focused playbook covers building voice and multimodal AI products in 2026, including architectures, latency budgets, cost modeling, evaluation, and governance checklists. The Building Voice & Multimodal AI Products 2026 article is a focused companion for Voice Agent Evaluation because it explicitly includes evaluation for voice and multimodal AI products, making it the most direct match for a marker about evaluating voice agents.

The most important evaluation rule is separation of evidence. A natural spoken answer is evidence of conversational quality, not evidence that the backend executed the task. A delegated response is evidence that backend work was attempted or completed inside a model or agent path, not evidence that an external service changed state. A final database record, ticket, booking, message draft, or permission change is evidence of application state, but not evidence that the user heard the result. Production tests need to capture all of those layers separately.

CRAWL: synthetic single-turn tests for intent, delegation, and state

The CRAWL stage should use short, controlled audio files that express one intent at a time. Examples include “What is the status of my order?”, “Move my appointment to Friday afternoon,” “Do you have availability next week?”, and “Cancel that request.” Each scenario needs a written expected outcome before the test runs, including whether delegation should occur, whether a tool should be called, whether approval is required, and what final state should exist if the request succeeds.

For no-action availability questions, passing means the agent answers from permitted information or delegates for lookup without creating a record. For missing-detail scenarios, passing means GPT-Live asks for the required field instead of guessing. For action scenarios, passing means the backend uses the correct authorized account, calls only permitted tools, records the expected state change, and confirms completion only after the application has verified the result.

{
  "scenario_id": "crawl-reschedule-appointment-001",
  "spoken_intent": "Move my appointment to Friday afternoon.",
  "expected_delegation": "required",
  "expected_tools": ["lookup_existing_appointment", "find_available_slots"],
  "approval_required_before_write": true,
  "forbidden_behavior": [
    "confirming reschedule before verified write",
    "guessing the appointment identity",
    "creating duplicate appointment",
    "using an unauthorized account"
  ],
  "pass_state": {
    "original_appointment_preserved_until_approval": true,
    "candidate_slots_returned": true,
    "write_performed_only_after_human_confirmation": true
  }
}

This test record is intentionally explicit about authorization and final state. GPT-Live’s live layer may handle interruption and turn-taking well, but OpenAI’s delegation guidance places permissions, confirmations, private function execution, business records, and durable task state in the application. A CRAWL test that checks only the spoken answer can pass a voice demo while missing the actual production risk.

WALK: saved recordings for realistic speech and interaction behavior

The WALK stage should replay saved recordings from consented test speakers or synthetic scenario generation approved for your organization’s testing program. The goal is not just speech recognition; it is to measure how the system behaves when users interrupt, self-correct, mumble alphanumeric identifiers, pause while thinking, speak over backchannels, or call from a noisy environment. OpenAI’s launch materials describe GPT-Live-1 as full-duplex and improved at interruption handling, but production teams still need their own measurements for their domain, audio path, and tools.

Saved recordings should include corrections that supersede prior intent, such as “Actually, don’t cancel it—just tell me the policy,” and conflicting utterances, such as “Stop talking” followed by “Cancel my booking.” The prompting and delegation guides make the boundary clear: stopping speech does not stop backend work. Therefore, WALK tests must verify that a spoken interruption changes only the speech behavior unless the application separately receives, authorizes, and reconciles a cancellation or replacement task.

Human reviewers should score WALK conversations separately for interaction quality and task quality. Interaction quality includes whether the system interrupted too often, left awkward silence, overused backchannels, spoke for too long, or failed to recover after overlapping speech. Task quality includes whether the intended outcome was achieved, mandatory constraints were respected, required approvals were obtained, and the final spoken update matched verified application state.

RUN: simulated continuous callers for production load and state management

The RUN stage should use simulated callers that can hold multi-turn conversations, revise goals, wait silently, interrupt, and ask follow-up questions while backend operations are still pending. These tests should run against a staging environment that resembles production permissions and tool behavior without exposing real customer secrets, protected health information, payment credentials, privileged legal material, or unnecessary personal identifiers.

A RUN scenario should contain multiple branches rather than one golden path. A caller may first ask an informational question, then request an action, then interrupt the confirmation, then change a date, then ask whether the action was actually completed. The pass condition is not that the agent sounds confident; it is that the system maintains durable task state, avoids duplicate writes, reconciles late backend results, and communicates uncertainty when the outcome is not verified.

Repeated trials are mandatory because voice systems are nondeterministic. A single clean call proves only that the scenario can pass once. Production readiness requires sample counts large enough to reveal variance in latency, speaking duration, delegation behavior, and interruption handling. Teams should report median and tail values, commonly P50 and P90, for user-perceived response latency, backend delegation duration, silence during delegation, and total scenario duration. P50 shows the typical experience; P90 shows what a significant minority of users may encounter when audio, model routing, tools, or network conditions are slower.

Metric definitions that prevent false confidence

Task completion should be scored against the written user goal and mandatory constraints. A reschedule request is complete only if the correct appointment was changed, the old state was not duplicated, the user authorized the write where required, and the final spoken message accurately described the verified state. A support-summary request is complete only if the summary uses permitted sources, distinguishes uncertainty, and does not claim actions that were not taken.

Tool accuracy should measure whether the correct tools were called, whether arguments were complete and authorized, whether the call count was expected, and whether no forbidden tool was used. Delegation accuracy should measure whether GPT-Live delegated only when deeper reasoning, lookup, or tool execution was needed, and whether it avoided delegation for simple conversational handling. Excess delegation can increase cost, latency, privacy exposure, and state complexity even when the final answer is acceptable.

Authorization should be evaluated before and after tool execution. Before execution, the application should verify that the user, workspace, connected account, and policy allow the requested read or write. Before consequential external actions, a human approval step is required. After execution, the evidence should show who approved, what was approved, which account or service was used, and what state changed. A generated confirmation sentence is not an approval record.

Final state should be checked in the authoritative application, not inferred from the model transcript. If a ticket, appointment, message, order, or internal record is involved, the test harness should query the staging system or controlled fixture after the call. If the external outcome is ambiguous because of a timeout or lost response, the system should report uncertainty and provide the next verification step rather than retry blindly or claim success.

Response rate should track how often the live agent responds when a user expects a response, including after pauses, corrections, and delegated work. Response latency should be measured from the end of the relevant user utterance, or from the point where the system has enough information to act, to the first meaningful audible response. Backend latency should be measured separately from voice-layer latency because OpenAI’s architecture and billing guidance separate the GPT-Live voice layer from backend model and tool usage.

Interruption rate should count both user interruptions of the model and model interruptions of the user. The goal is not always zero interruptions because full-duplex systems need natural backchannels, but unwanted interruptions during user speech, thinking pauses, or sensitive confirmations can damage trust. Speaking duration should identify responses that are too long for voice. Silence during delegation should identify gaps where the agent fails to set expectations, but backchannels must not become false confirmations.

Consumption should be attributed separately for the voice layer and backend work. The GPT-Live announcement stated launch pricing for the voice layer and noted that backend and tool usage are separate; production dashboards should therefore avoid treating a call as a single opaque cost item. A useful cost record includes session duration, number of delegated tasks, backend model usage where available, tool-call count, retries, failed calls, and calls requiring human review.

A go/no-go matrix for production rollout

A go/no-go decision should be scenario-specific. An agent may be ready for informational triage but not for scheduling writes. It may be ready for browser WebRTC pilots but not SIP traffic. It may be safe with Responses delegation for a narrow workflow but not ready for client delegation across multiple backend services. The release gate should reflect the actual capability being enabled.

Teams should write numeric thresholds before testing begins, not after reviewing favorable runs. The official sources do not prescribe universal P50, P90, interruption, or consumption targets because acceptable values depend on domain, channel, user tolerance, backend tools, and risk. A banking, healthcare, legal, HR, or security workflow should use stricter authorization, review, and escalation rules than a low-risk FAQ agent.

Incident evidence: what to retain when a voice task goes wrong

Incident evidence should be sufficient to reconstruct the path from spoken intent to final state. At minimum, retain the scenario identifier, session identifier, timestamps, audio or approved recording reference, transcript segments with known limitations, delegation mode, delegation IDs, backend requests, tool calls, tool results, approval prompts, human approval records, state snapshots before and after writes, spoken or textual response content, and consumption records. Access to this evidence should follow the organization’s privacy, retention, and security policies.

For failed or ambiguous tool calls, the evidence package should identify whether the original action might have occurred. OpenAI’s delegation guidance warns that retrying a failed tool call without verifying state can create duplicate bookings or messages. The safe incident procedure is to freeze automatic retries for that action class, query the authoritative system, record whether the outcome is known, and notify the user or operator with uncertainty rather than a fabricated completion claim.

{
  "incident_id": "voice-run-incident-042",
  "symptom": "user interrupted cancellation confirmation; backend write outcome unclear",
  "required_evidence": [
    "audio_reference",
    "transcript_segments",
    "delegation_id",
    "tool_call_id",
    "approval_record",
    "pre_action_state",
    "post_timeout_state_check",
    "spoken_user_update",
    "operator_resolution"
  ],
  "immediate_controls": [
    "disable automatic retry for matching action",
    "require manual state verification",
    "preserve logs under retention policy",
    "review prompt and backend cancellation handling"
  ]
}

Human review should not be limited to failures. Reviewers should inspect passing samples for subtle problems: overconfident wording, unnecessary collection of sensitive details, confusing pauses, excessive speaking time, poor correction handling, and cases where the system technically completed the task but created a poor user experience. Independent review is especially important when the same team wrote the prompts, backend harness, and test scenarios.

Operational conclusion

GPT-Live-1 changes what API voice systems can feel like because the model can listen and speak simultaneously while delegating deeper work to a backend path. The production boundary remains firm: the application owns permissions, approvals, durable state, private function execution, final verification, and incident reconstruction. Full-duplex speech can make a workflow feel continuous, but it does not remove the need for explicit state machines, idempotent tools, human approval for consequential actions, and evidence that separates what was heard, what was delegated, what was executed, and what actually changed.

The safest production program starts small with CRAWL tests, expands realism through WALK recordings, and earns rollout confidence through RUN simulations with repeated trials, P50/P90 reporting, and human review. Treat OpenAI’s launch claims as useful context, not as a substitute for your own measurements. Treat every confirmation as provisional until the application has verified state. Treat every interruption as a speech event unless the backend has separately processed an authorized task change. That discipline is what turns a compelling voice demo into an auditable production system.

Useful Links

• OpenAI: Introducing GPT-Live-1 in the API
• OpenAI Developers: Live API guide
• OpenAI Developers: Live prompting guide
• OpenAI Developers: Live delegation guide
• OpenAI Cookbook: Voice agent evaluation