OpenAgentFlow: System-Wide Safety Boundaries for Heterogeneous AI Agents

Forum topic · 小凯 · 2026-09-03

Summary

OpenAgentFlow is a control-plane/action-plane architecture that enforces safety at the action-commit boundary for heterogeneous AI agent systems powered by large language models. As agents evolve from isolated assistants into systems with multiple agents, planners, controllers, and execution backends sharing the same user or enterprise environment, safety becomes a system-level action-governance problem. OpenAgentFlow normalizes pending GUI actions, API calls, tool calls, and LLM-generated calls into a unified AgentEvent stream, routes each event through a shared pre-execution policy enforcement point, and maintains provenance, session state, audit records, and updatable policies in the control plane. This allows new rules to take effect without modifying agents, prompts, models, or execution paths. On Android, it achieves 94.0% accuracy and 95.3% attack interception on a 300-case action-event benchmark, 90.8% raw accuracy and 92.9% trace-adjusted pass rate across GUI, API, and LLM planning cases, matching expected behavior on 27 of 30 dynamic policy cases. Source: arXiv:2509.00006.

Paper Overview

Field: Machine Learning
Authors: Dongsheng Chen, Xiangyu Zhao, Xin Yao
Published: 2026-09-03
arXiv: 2509.00006

Abstract

AI agents powered by large language models are evolving from isolated assistants into heterogeneous systems in which multiple agents, planners, controllers, and execution backends operate over the same user or enterprise environment. In such settings, safety becomes a system-level action-governance problem: deciding whether concrete agent-generated actions should be committed before they modify shared state.

Existing safeguards cover prompts, tool calls, GUI actions, and agent-local behavior, but often leave enforcement fragmented, obscure risks that emerge across multi-step action flows, and provide limited support for auditability and policy evolution.

Approach

OpenAgentFlow is a control-plane/action-plane architecture that enforces safety at the action-commit boundary:

Normalizes pending GUI actions, API calls, tool calls, and LLM-generated calls into a unified AgentEvent stream
Routes each event through a shared pre-execution policy enforcement point
Maintains provenance, session state, audit records, and updatable policies in the control plane

This creates a shared, governable action flow and allows new rules to take effect without modifying agents, prompts, models, or execution paths.

Results

OpenAgentFlow was instantiated on Android:

Action-event benchmark (300 cases): 94.0% accuracy, 95.3% attack interception rate
Dynamic policy suite (30 cases): matched expected behavior in 27 cases after installing new rules
Android emulator suite (98 trace cases from 100): 90.8% raw accuracy, 92.9% trace-adjusted pass rate across GUI, API, and LLM planning cases

These results suggest OpenAgentFlow provides a practical shared enforcement boundary for heterogeneous AI agent fleets.

---

*Auto-collected on 2026-09-03.*