Agentao: A Governed Local-First Runtime for Tool-Using LLM Agents

Agentao：面向工具使用型 LLM 智能体的受控本地优先运行时

LLM agents increasingly operate as execution systems that invoke tools, modify local state, use persistent memory, and interact with external protocols. These capabilities make agents useful, but they also introduce risks related to over-privileged actions, weak auditability, prompt injection, tool poisoning, and uncontrolled side effects.

LLM 智能体正日益演变为执行系统，能够调用工具、修改本地状态、使用持久化内存并与外部协议交互。这些能力虽然提升了智能体的实用性，但也带来了诸多风险，例如权限过大、审计能力薄弱、提示词注入、工具投毒以及不可控的副作用。

This paper presents Agentao, a governed local-first runtime for tool-using LLM agents. Agentao separates model-generated action proposals from host-authorized execution through a layered architecture consisting of host-facing surfaces, a host contract, a runtime core, a permission-mediated tool system, and supporting subsystems for memory, replay, plugins, skills, sub-agents, and protocol integration.

本文介绍了 Agentao，这是一个专为工具使用型 LLM 智能体设计的受控本地优先运行时。Agentao 通过分层架构将模型生成的行动建议与宿主授权的执行过程分离开来。该架构包含面向宿主的接口、宿主契约、运行时核心、权限中介工具系统，以及用于内存、重放、插件、技能、子智能体和协议集成的支持子系统。

We describe the motivation, threat model, design goals, governance model, execution pipeline, and structured event interface of the system. Agentao does not provide formal safety guarantees; rather, it demonstrates how permissions, state, protocol boundaries, and execution traces can be made explicit runtime abstractions for building agents that are more governable, inspectable, and suitable for host-controlled local environments.

我们详细阐述了该系统的动机、威胁模型、设计目标、治理模型、执行流水线以及结构化事件接口。Agentao 并不提供形式化的安全保证；相反，它展示了如何将权限、状态、协议边界和执行轨迹转化为显式的运行时抽象，从而构建出更易于治理、可审计且适用于宿主控制的本地环境的智能体。

The code is publicly available at this https URL.

代码已在以下链接公开：[https URL]