Agentao runtime gives LLM agents governed, auditable tool execution

Agentao, introduced by researchers Bo Jin, Qiang Jiao, and Xin Tong in an arXiv paper, is a new governed local-first runtime designed for LLM agents that invoke tools, modify local state, use persistent memory, and interact with external protocols. The system's core insight is to separate model-generated action proposals from host-authorized execution. By doing so, Agentao turns permissions, state, protocol boundaries, and execution traces into explicit runtime abstractions, making agent behavior more governable, inspectable, and suitable for host-controlled environments. The architecture includes host-facing surfaces, a host contract, a runtime core, a permission-mediated tool system, and subsystems for memory, replay, plugins, skills, sub-agents, and protocol integration.

The motivation behind Agentao is the growing risk of over-privileged actions, weak auditability, prompt injection, tool poisoning, and uncontrolled side effects as agents become more capable execution systems. Rather than claiming formal safety guarantees, Agentao demonstrates how to make governance and inspection first-class runtime concerns. Its structured event interface and replay support give developers a clear audit trail of what the agent proposed versus what actually ran, which is critical for debugging and security. The code is publicly available on GitHub, but the paper is still early-stage, with experimental results planned for future releases. For builders deploying tool-using agents in local or enterprise environments, Agentao offers a practical blueprint for adding control and transparency without wrapping everything in heavy guardrails.