让大模型工具代理在本地受控运行，防止越权操作。
Agentao: A Policy-Governed Runtime Harness for Embeddable Tool-Using LLM Agents
- 用分层架构分离模型提议与主机授权，实现动作管控
- 支持记忆、回放、插件等模块化功能，提升可追踪性
- 适合需要安全可控的本地部署场景，如企业私有应用
大型语言模型代理正日益作为执行系统，调用工具、修改本地状态、使用持久化记忆并交互外部协议。这些能力虽增强实用性，但也带来越权行为、审计困难、提示注入、工具污染及不可控副作用等风险。本文提出 Agentao，一种面向本地优先的工具型大模型代理治理运行时。Agentao 通过分层架构将模型生成的动作建议与主机授权执行分离，包含面向主机的接口、主机契约、运行时核心、权限管理的工具系统，以及支持记忆、回放、插件、技能、子代理和协议集成的子系统。系统不提供形式化安全保证，但展示了如何将权限、状态、协议边界与执行痕迹显式建模为运行时抽象，使代理更可治理、可检查，适用于主机控制的本地环境。代码已公开于 https://github.com/jin-bo/agentao。
原文摘要 · Abstract (English)
LLM agents increasingly operate as execution systems that invoke tools, modify local state, use persistent memory, and interact with external protocols. These capabilities make agents useful, but they also introduce risks related to over-privileged actions, weak auditability, prompt injection, tool poisoning, and uncontrolled side effects. This paper presents Agentao, a governed local-first runtime for tool-using LLM agents. Agentao separates model-generated action proposals from host-authorized execution through a layered architecture consisting of host-facing surfaces, a host contract, a runtime core, a permission-mediated tool system, and supporting subsystems for memory, replay, plugins, skills, sub-agents, and protocol integration. We describe the motivation, threat model, design goals, governance model, execution pipeline, and structured event interface of the system. Agentao does not provide formal safety guarantees; rather, it demonstrates how permissions, state, protocol boundaries, and execution traces can be made explicit runtime abstractions for building agents that are more governable, inspectable, and suitable for host-controlled local environments. The code is publicly available at https://github.com/jin-bo/agentao .
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。