为AI代理工具访问设计安全治理协议，实现权限最小化与操作可审计。
OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access
- 通过网关式架构实现模型无关的工具访问治理，支持细粒度权限控制。
- 写操作默认为草稿并需人工审核，高风险操作强制预检与幂等性保障。
- 提供状态见证机制防审批延迟导致的漏洞，适合生产级AI系统使用。
AI代理日益需要直接、结构化地访问应用数据和操作，但实际部署仍难以表达和验证关键治理属性：最小权限授权、可控写入执行、可预测失败处理、抗滥用能力及可审计性。本文提出OpenPort协议（OPP），一种以治理为核心的工具访问规范，通过安全的服务器端网关暴露应用工具，具备模型与运行时中立性，并可集成现有工具生态。OPP定义了基于授权的发现机制、带机器可读的 exttt{agent.*}原因码的稳定响应封装，以及结合集成凭证、作用域权限与ABAC风格策略约束的授权模型。对于写操作，协议规定风险分级生命周期：默认创建草稿并需人工审查，支持显式策略下的限时自动执行，强制实施高风险防护措施，包括预检影响绑定与幂等性。为应对延迟审批中的时间-检查/时间-使用漂移问题，OPP还引入可选的State Witness配置文件，重新验证执行时前提条件，在状态不匹配时关闭失败。在运营层面，协议要求准入控制（速率限制/配额）并保持稳定的429语义，以及在允许/拒绝/失败路径上生成结构化审计事件，确保客户端恢复与事故分析的确定性。我们提供参考运行时与可执行治理工具链（分层符合性配置文件、负向安全测试、模糊/滥用回归测试、发布门禁扫描），并通过基于工件的外部可复现验证评估核心配置文件在固定版本标签下的表现。
原文摘要 · Abstract (English)
AI agents increasingly require direct, structured access to application data and actions, but production deployments still struggle to express and verify the governance properties that matter in practice: least-privilege authorization, controlled write execution, predictable failure handling, abuse resistance, and auditability. This paper introduces OpenPort Protocol (OPP), a governance-first specification for exposing application tools through a secure server-side gateway that is model- and runtime-neutral and can bind to existing tool ecosystems. OpenPort defines authorization-dependent discovery, stable response envelopes with machine-actionable \texttt{agent.*} reason codes, and an authorization model combining integration credentials, scoped permissions, and ABAC-style policy constraints. For write operations, OpenPort specifies a risk-gated lifecycle that defaults to draft creation and human review, supports time-bounded auto-execution under explicit policy, and enforces high-risk safeguards including preflight impact binding and idempotency. To address time-of-check/time-of-use drift in delayed approval flows, OpenPort also specifies an optional State Witness profile that revalidates execution-time preconditions and fails closed on state mismatch. Operationally, the protocol requires admission control (rate limits/quotas) with stable 429 semantics and structured audit events across allow/deny/fail paths so that client recovery and incident analysis are deterministic. We present a reference runtime and an executable governance toolchain (layered conformance profiles, negative security tests, fuzz/abuse regression, and release-gate scans) and evaluate the core profile at a pinned release tag using artifact-based, externally reproducible validation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。