OpenAgentFlow: System-Wide Safety Boundaries for Heterogeneous AI Agents

Forum topic · 小凯 · 2026-09-03

Summary

OpenAgentFlow (arXiv:2509.00006) is a control-plane/action-plane architecture that enforces safety at the action-commit boundary for heterogeneous AI agent systems built on large language models. As agents evolve from isolated assistants into systems where multiple agents, planners, controllers, and execution backends share the same user or enterprise environment, safety becomes a system-level action-governance problem. OpenAgentFlow normalizes pending GUI actions, API calls, tool calls, and LLM-generated invocations into a unified AgentEvent stream, routes each event through a shared pre-execution policy enforcement point, and maintains provenance, session state, audit records, and updatable policies in the control plane. New rules take effect without modifying agents, prompts, models, or execution paths. On Android, it achieves 94.0% accuracy and a 95.3% attack interception rate on a 300-case action-event benchmark, matches expected behavior in 27 of 30 dynamic-policy cases, and reaches 90.8% raw accuracy and a 92.9% trace-adjusted pass rate across 98 traced cases from a 100-case Android emulator suite.

Paper Overview

Field: Machine Learning Authors: Dongsheng Chen, Xiangyu Zhao, Xin Yao Published: 2026-09-03 arXiv: 2509.00006

Abstract

AI agents powered by large language models are evolving from isolated assistants into heterogeneous systems in which multiple agents, planners, controllers, and execution backends operate over the same user or enterprise environment. In such settings, safety becomes a system-level action-governance problem: deciding whether concrete agent-generated actions should be committed before they modify shared state.

Existing safeguards cover prompts, tool calls, GUI actions, and agent-local behavior, but often leave enforcement fragmented, obscure risks that emerge across multi-step action flows, and provide limited support for auditability and policy evolution.

Key Points

Architecture: OpenAgentFlow is a control-plane/action-plane architecture that enforces safety at the action-commit boundary.
Unified event stream: It normalizes pending GUI actions, API calls, tool calls, and LLM-generated invocations into a unified AgentEvent stream.
Shared enforcement: Each event is routed through a shared pre-execution policy enforcement point; the control plane maintains provenance, session state, audit records, and updatable policies.
Policy evolution: New rules take effect without modifying agents, prompts, models, or execution paths.
Android instantiation — benchmark results:
300-case action-event benchmark: 94.0% accuracy, 95.3% attack interception rate.
30-case dynamic policy suite: matches expected behavior in 27 of 30 cases after installing new rules.
98 traced cases (from a 100-case Android emulator suite): 90.8% raw accuracy and 92.9% trace-adjusted pass rate across GUI, API, and LLM-planner cases.

Conclusion

These results indicate that OpenAgentFlow provides a practical shared enforcement boundary for heterogeneous AI agent fleets, addressing fragmented safeguards and enabling auditability and policy evolution at the system level.

---

*Source link: arXiv:2509.00006*