OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access

Overview

AI agents need more than a list of callable tools. They need a server-side boundary that decides what a credential may discover, what it may read, and how proposed writes are reviewed and executed.

OpenPort defines that boundary through authorization-dependent discovery, scoped and attribute-based policy checks, draft-first writes, high-risk preflight and replay safeguards, stable machine-readable failures, rate limits, and structured audit events. A reference runtime and conformance tooling make these governance properties executable and testable across models and agent runtimes.

Abstract

AI agents increasingly require direct, structured access to application data and actions, but production deployments still struggle to express and verify the governance properties that matter in practice: least-privilege authorization, controlled write execution, predictable failure handling, abuse resistance, and auditability. This paper introduces OpenPort Protocol (OPP), a governance-first specification for exposing application tools through a secure server-side gateway that is model- and runtime-neutral and can bind to existing tool ecosystems. OpenPort defines authorization-dependent discovery, stable response envelopes with machine-actionable agent.* reason codes, and an authorization model combining integration credentials, scoped permissions, and ABAC-style policy constraints. For write operations, OpenPort specifies a risk-gated lifecycle that defaults to draft creation and human review, supports time-bounded auto-execution under explicit policy, and enforces high-risk safeguards including preflight impact binding and idempotency. To address time-of-check/time-of-use drift in delayed approval flows, OpenPort also specifies an optional State Witness profile that revalidates execution-time preconditions and fails closed on state mismatch. Operationally, the protocol requires admission control (rate limits/quotas) with stable 429 semantics and structured audit events across allow/deny/fail paths so that client recovery and incident analysis are deterministic. We present a reference runtime and an executable governance toolchain (layered conformance profiles, negative security tests, fuzz/abuse regression, and release-gate scans) and evaluate the core profile at a pinned release tag using artifact-based, externally reproducible validation.

Core contributions

1. 01

   Protocol contract

   Defines a model- and runtime-neutral interface for tool discovery and invocation, including endpoints, response envelopes, tool metadata, and stable agent.* reason codes.

2. 02

   Governed execution

   Combines integration credentials, scopes, and ABAC-style constraints with draft-first writes, preflight impact binding, idempotency, optional State Witness checks, rate limits, and structured audit.

3. 03

   Executable verification

   Pairs the specification with a reference runtime, layered conformance profiles, negative security tests, fuzz and abuse regression, and release-gate checks.

Cite this work

Use the DOI for a stable reference. The BibTeX record below identifies the arXiv version shown on this page.

Zhu, G., Wang, C., Wang, Z., Li, Z., & Li, Q. (2026). OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2602.20196

@misc{zhu2026openport,
  title         = {{OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access}},
  author        = {Zhu, Genliang and Wang, Chu and Wang, Ziyuan and Li, Zhida and Li, Qiang},
  year          = {2026},
  month         = feb,
  eprint        = {2602.20196},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR},
  doi           = {10.48550/arXiv.2602.20196},
  url           = {https://arxiv.org/abs/2602.20196},
  note          = {arXiv:2602.20196v1}
}