Agentao: a local-first agent runtime that separates what the model proposes from what the host authorizes — and admits it has no formal guarantees

arXiv·low signalXBlueskyLinkedInCopy link

Agentao (arXiv:2608.13574, Bo Jin, Qiang Jiao, Xin Tong) is a governed local-first runtime for tool-using LLM agents, targeting over-privileged tool access, audit gaps, prompt injection, tool contamination and unintended side effects through a layered design that splits model proposals from host authorization, with memory management, execution replay and plugin/protocol integration. The authors explicitly state it provides no formal safety guarantees and instead aims to make permissions, state, execution boundaries and traces legible. Code is on GitHub; the honesty about scope is worth more than the architecture diagram.