OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access
OpenPort Protocol：面向 AI 智能体工具访问的安全治理规范
为 AI 智能体提供结构化工具访问，同时将授权、写入控制与审计牢牢保留在服务端。
Genliang Zhu, Chu Wang, Ziyuan Wang, Zhida Li, Qiang Li
研究概览
AI 智能体需要的不只是一份可以调用的工具清单。系统还需要一条由服务端执行的治理边界，用来决定某个凭证当前可以发现哪些能力、读取哪些数据，以及写入请求应当如何被审查和执行。
OpenPort 通过感知授权的工具发现、作用域与属性策略检查、草稿优先写入、高风险操作的 preflight 与重放保护、机器可处理的稳定失败语义、速率限制和结构化审计事件来定义这条边界。参考运行时与一致性验证工具，则使这些治理要求能够跨模型和智能体运行时被实际执行和检验。
英文摘要
AI agents increasingly require direct, structured access to application data and actions, but production deployments still struggle to express and verify the governance properties that matter in practice: least-privilege authorization, controlled write execution, predictable failure handling, abuse resistance, and auditability. This paper introduces OpenPort Protocol (OPP), a governance-first specification for exposing application tools through a secure server-side gateway that is model- and runtime-neutral and can bind to existing tool ecosystems. OpenPort defines authorization-dependent discovery, stable response envelopes with machine-actionable agent.* reason codes, and an authorization model combining integration credentials, scoped permissions, and ABAC-style policy constraints. For write operations, OpenPort specifies a risk-gated lifecycle that defaults to draft creation and human review, supports time-bounded auto-execution under explicit policy, and enforces high-risk safeguards including preflight impact binding and idempotency. To address time-of-check/time-of-use drift in delayed approval flows, OpenPort also specifies an optional State Witness profile that revalidates execution-time preconditions and fails closed on state mismatch. Operationally, the protocol requires admission control (rate limits/quotas) with stable 429 semantics and structured audit events across allow/deny/fail paths so that client recovery and incident analysis are deterministic. We present a reference runtime and an executable governance toolchain (layered conformance profiles, negative security tests, fuzz/abuse regression, and release-gate scans) and evaluate the core profile at a pinned release tag using artifact-based, externally reproducible validation.
核心贡献
- 01
协议契约
定义与模型和运行时无关的工具发现及调用接口，包括端点、响应封装、工具元数据与稳定的 agent.* 原因码。
- 02
受治理的执行路径
将集成凭证、作用域与 ABAC 风格策略约束，同草稿优先写入、preflight 影响绑定、幂等性、可选 State Witness、速率限制和结构化审计结合起来。
- 03
可执行验证
将规范与参考运行时、分层一致性配置、负向安全测试、模糊及滥用回归测试和发布门禁配套交付。
证据与适用范围
本文目前是 arXiv v1 预印本，其验证对象是在 v0.1.0 标签下最小参考运行时所呈现的协议不变量。论文并未宣称该最小运行时已具备生产就绪性；当时仍有部分增强控制处于部分覆盖或后续工作阶段，生产部署还需要持久化治理状态、分布式准入控制和经过强化的领域适配器。
引用本文
建议使用 DOI 作为稳定引用。下方 BibTeX 记录对应本页面标注的 arXiv 版本。
Zhu, G., Wang, C., Wang, Z., Li, Z., & Li, Q. (2026). OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2602.20196
@misc{zhu2026openport,
title = {{OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access}},
author = {Zhu, Genliang and Wang, Chu and Wang, Ziyuan and Li, Zhida and Li, Qiang},
year = {2026},
month = feb,
eprint = {2602.20196},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
doi = {10.48550/arXiv.2602.20196},
url = {https://arxiv.org/abs/2602.20196},
note = {arXiv:2602.20196v1}
}