A new runtime treats AI agents like unprivileged processes, forcing every tool call through a permission check before it runs.
Researchers describe Agentao, a governed local-first runtime for tool-using LLM agents, in a paper posted to arXiv. The system splits model-generated action proposals from host-authorized execution using a layered architecture: host-facing surfaces, a host contract, a runtime core, and a permission-mediated tool system. Supporting subsystems handle memory, replay, plugins, skills, sub-agents, and protocol integration. The paper lays out the threat model, governance model, execution pipeline, and a structured event interface, and the code is public on GitHub.
The target problem is real. As agents move beyond chat and start editing local files, calling external tools, and holding memory across sessions, the failure modes multiply: over-privileged actions, weak auditability, prompt injection, tool poisoning, and side effects nobody asked for. Agentao's answer is to make permissions, state, and execution traces explicit parts of the runtime rather than something bolted on after the fact.
Worth noting: the authors are upfront that this is not a formal safety guarantee. It is an architecture for making agents more inspectable and host-controlled, not a proof they can't be fooled. That distinction matters more than usual in a field where "governance layer" often means a logging wrapper dressed up as a safety feature.