Agentao: A Governed Local-First Runtime for Tool-Using LLM Agents
06:00 · August 17, 2026 · arXiv cs.AI RSS
LLM agents increasingly operate as execution systems that invoke tools, modify local state, use persistent memory, and interact with external protocols. These capabilities make agents useful, but they also introduce risks related to over-privileged actions, weak auditability, prompt injection, tool poisoning, and uncontrolled side effects. This paper presents Agentao, a governed local-first runtime for tool-using LLM agents. Agentao separates model-generated action proposals from host-authorized execution through a layered architecture consisting of host-facing surfaces, a host contract, a runtime core, a permission-mediated tool system, and supporting subsystems for memory, replay, plugins, skills, sub-agents, and protocol integration. We describe the motivation, threat model, design goals, governance model, execution pipeline, and structured event interface of the system. Agentao does not provide formal safety guarantees; rather, it demonstrates how permissions, state, protocol boundaries, and execution traces can be made explicit runtime abstractions for building agents that are more governable, inspectable, and suitable for host-controlled local environments. The code is publicly available at https://github.com/jin-bo/agentao.
Summary
Agentao addresses the growing demands placed on LLM agents that function as execution systems rather than simple text generators. These agents invoke tools, alter local state, maintain persistent memory, and interact with external protocols, which introduces concrete risks including over-privileged actions, prompt injection, tool poisoning, weak auditability, and uncontrolled side effects. The system responds by treating governance as a runtime property rather than a matter of prompting or model alignment alone.
Its core mechanism separates model-generated action proposals from host-authorized execution. A layered architecture mediates this separation through host-facing surfaces, a defined host contract, a runtime core, and a permission-mediated tool system. Supporting subsystems handle memory, replay, plugins, skills, sub-agents, and protocol integration, allowing capabilities from different sources to be composed under consistent authority boundaries.
Permission modes and confirmation flows enforce consent before actions occur, while sandbox-aware execution and scoped memory limit the reach of any single operation. Structured event interfaces produce traceable records of decisions and outcomes, enabling inspection, debugging, and replay without requiring the host to trust implicit agent behavior. Protocol boundaries such as those defined by the Model Context Protocol and Agent Client Protocol are routed through the same governance layer rather than integrated ad hoc.
The design deliberately stops short of formal safety guarantees. Instead, it demonstrates how explicit runtime abstractions for permissions, state, protocol boundaries, and execution traces can make agents more governable and inspectable within host-controlled local environments. The publicly available implementation serves as a concrete reference for embedding such controls in practical agent deployments.
Why it matters
Agentao's focus on runtime governance, auditability, and permission-mediated execution aligns strongly with the transparency and human-oversight requirements of the EU AI Act. Dutch AI researchers and engineers can leverage this open-source architecture to build compliant, secure, and inspectable local-first AI agents.
