OpenAgentFlow: Enabling System-Wide Safety Boundaries for Heterogeneous AI Agent Fleets

OpenAgentFlow：为异构 AI 智能体集群构建系统级安全边界

Abstract: AI agents powered by large language models are evolving from isolated assistants into heterogeneous systems in which multiple agents, planners, controllers, and execution backends operate over the same user or enterprise environment. In such settings, safety becomes a system-level action-governance problem: deciding whether concrete agent-generated actions should be committed before they modify shared state.

摘要： 由大语言模型驱动的 AI 智能体正在从孤立的助手演变为异构系统，其中多个智能体、规划器、控制器和执行后端在同一个用户或企业环境中协同工作。在这种环境下，安全性演变为一个系统级的行动治理问题：即在智能体生成的具体行动修改共享状态之前，决定是否应执行这些行动。

Existing safeguards cover prompts, tool calls, GUI actions, and agent-local behavior, but often leave enforcement fragmented, obscure risks that emerge across multi-step action flows, and provide limited support for auditability and policy evolution.

现有的安全防护措施涵盖了提示词、工具调用、GUI 操作和智能体本地行为，但往往导致执行碎片化，难以发现跨多步行动流程中出现的风险，且在可审计性和策略演进方面的支持有限。

We present OpenAgentFlow, a control-plane/action-plane architecture that enforces safety at the action-commit boundary. It normalizes pending GUI actions, API calls, tool calls, and LLM-generated invocations into a unified AgentEvent stream, routes each event through a shared pre-execution Policy Enforcement Point, and maintains provenance, session state, audit records, and updatable policies in the control plane.

我们提出了 OpenAgentFlow，这是一种在行动提交边界实施安全性的控制平面/行动平面架构。它将待处理的 GUI 操作、API 调用、工具调用和 LLM 生成的调用标准化为统一的 AgentEvent 流，通过共享的预执行策略执行点路由每个事件，并在控制平面中维护来源、会话状态、审计记录和可更新的策略。

This creates a shared governable action stream and allows new rules to take effect without modifying agents, prompts, models, or execution paths.

这创建了一个共享的可治理行动流，并允许在不修改智能体、提示词、模型或执行路径的情况下使新规则生效。

We instantiate OpenAgentFlow on Android. On a 300-case action-event benchmark, it achieves 94.0% accuracy and a 95.3% attack block rate. On a 30-case dynamic-policy suite, it matches expected behavior in 27 cases after new rules are installed. Across 98 traced cases from a 100-case Android emulator suite, it achieves 90.8% raw accuracy and a 92.9% trace-adjusted pass rate across GUI, API, and LLM-planned cases. These results show that OpenAgentFlow provides a practical shared enforcement boundary for heterogeneous AI agent fleets.

我们在 Android 系统上实例化了 OpenAgentFlow。在包含 300 个案例的行动事件基准测试中，它达到了 94.0% 的准确率和 95.3% 的攻击拦截率。在 30 个案例的动态策略套件中，安装新规则后，有 27 个案例符合预期行为。在 100 个 Android 模拟器案例的 98 个追踪案例中，它在 GUI、API 和 LLM 规划案例中实现了 90.8% 的原始准确率和 92.9% 的追踪调整后通过率。这些结果表明，OpenAgentFlow 为异构 AI 智能体集群提供了一个实用的共享执行边界。