为自主代理系统提供可强制执行的实时授权控制，防止意外操作。
Faramesh: A Protocol-Agnostic Execution Control Plane for Autonomous Agent Systems
- 通过统一动作表示与不可绕过的授权边界，实现执行时强制验证。
- 动作决策结果（允许/推迟/拒绝）可追溯、可审计、可重放。
- 兼容多种框架和协议，适合多代理多租户场景下的安全管控。
自主代理系统正引发真实世界后果：部署基础设施、修改数据库、转账及执行工作流。然而多数代理架构缺乏强制性的执行检查点，无法在操作改变现实前进行确定性审批。本文提出 Faramesh，一种协议无关的执行控制平面，通过不可绕过的动作授权边界（AAB）在执行时强制授权。该系统将代理意图归一化为标准动作表示（CAR），基于策略与状态进行确定性评估，并生成决策凭证（PERMIT/DEFER/DENY），执行器必须验证后方可执行。系统设计为框架与模型无关，支持多代理与多租户部署，独立于传输协议（如 MCP）。Faramesh 还提供以标准动作哈希为键的、仅追加的溯源日志，实现审计、验证与无需重跑推理的确定性回放。这些机制共同实现可执行、可预测的自治执行治理，避免与编排层或仅可观测性方案产生隐式耦合。
原文摘要 · Abstract (English)
Autonomous agent systems increasingly trigger real-world side effects: deploying infrastructure, modifying databases, moving money, and executing workflows. Yet most agent stacks provide no mandatory execution checkpoint where organizations can deterministically permit, deny, or defer an action before it changes reality. This paper introduces Faramesh, a protocol-agnostic execution control plane that enforces execution-time authorization for agent-driven actions via a non-bypassable Action Authorization Boundary (AAB). Faramesh canonicalizes agent intent into a Canonical Action Representation (CAR), evaluates actions deterministically against policy and state, and issues a decision artifact (PERMIT/DEFER/DENY) that executors must validate prior to execution. The system is designed to be framework- and model-agnostic, supports multi-agent and multi-tenant deployments, and remains independent of transport protocols (e.g., MCP). Faramesh further provides decision-centric, append-only provenance logging keyed by canonical action hashes, enabling auditability, verification, and deterministic replay without re-running agent reasoning. We show how these primitives yield enforceable, predictable governance for autonomous execution while avoiding hidden coupling to orchestration layers or observability-only approaches.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。