Agentao: A Governed Local-First Runtime for Tool-Using LLM Agents

Large language model agents are moving beyond simple chat to become execution systems that call tools, modify local state, and interact with external services. While this expands their utility, it also raises safety concerns such as over‑privileged actions, weak audit trails, prompt injection, tool poisoning, and uncontrolled side effects. Researchers have begun looking for runtimes that can enforce boundaries without sacrificing the flexibility agents need to perform useful work.

What You Need to Know

Agentao is a governed local‑first runtime designed specifically for tool‑using LLM agents. Its core idea is to keep the model’s raw action proposals separate from the host’s actual execution decisions. By inserting an authorization layer between the model and the host, Agentao ensures that every proposed tool call, memory write, or protocol interaction must be approved before it can affect the system.

The runtime follows a layered architecture: host‑facing surfaces expose a minimal API to the application; a host contract defines the security policy that the host must enforce; the runtime core mediates between the model and the host contract; a permission‑mediated tool system checks each tool invocation against the contract; and supporting subsystems handle persistent memory, replay of past actions, plugin loading, skill composition, sub‑agent spawning, and protocol integration. All components run locally, giving the host full visibility and control over the agent’s state.

Agentao addresses the main risks identified in the literature. Over‑privileged actions are blocked by the permission mediator; weak auditability is countered by immutable replay logs that record every approved action; prompt injection is mitigated because the model never directly writes to host state; tool poisoning is prevented by validating tool signatures against the host contract; and uncontrolled side effects are limited to the scope granted by the contract.

Why It Matters

As LLM agents become embedded in productivity tools, autonomous workflows, and critical infrastructure, the need for provable safety guarantees grows. Agentao provides a concrete mechanism for developers to enforce least‑privilege principles without rewriting their agent logic. By making the authorization decision explicit and host‑driven, it shifts the trust boundary from the model—a black‑box component—to a configurable, auditable policy.

Beyond safety, the local‑first design improves privacy and latency. Since all state and execution remain on the host’s device, sensitive data never leaves the environment unless explicitly permitted via the contract. This makes Agentao suitable for settings where data residency requirements or network unreliability would otherwise hinder agent deployment.

Key Details

• Host‑facing surface: thin API that the application uses to send model proposals and receive results.
• Host contract: declarative policy (e.g., ACLs, time‑outs, resource limits) that the runtime enforces.
• Runtime core: scheduler that queues model proposals, invokes the permission mediator, and dispatches approved actions.
• Permission‑mediated tool system: wraps each tool with a check against the host contract before execution.
• Supporting subsystems: persistent memory with versioned replay, plugin loader, skill library, sub‑agent factory, and protocol adapters for HTTP, WebSockets, and custom IPC.

What’s Next

The authors plan to formalize the host contract language using lightweight temporal logic to enable automated verification of safety properties. They also intend to extend Agentao to multi‑agent scenarios where contracts can be composed hierarchically, and to explore integration with existing LLM serving frameworks such as vLLM and TensorRT‑LLM. Community feedback will drive the addition of standardized tool signatures and a sandboxed plugin marketplace.

📌 Source: Arxiv Ai