Accentrust
搜尋註冊登入
研究論文預印本 · arXiv v1

OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access

OpenPort Protocol：面向 AI 智能體工具存取的安全治理規範

為 AI 智能體提供結構化工具存取，同時將授權、寫入控制與稽核牢牢保留在服務端。

Genliang Zhu, Chu Wang, Ziyuan Wang, Zhida Li, Qiang Li

呈現受治理 AI 工具存取的抽象分層系統。

研究概覽

AI 智能體需要的不只是一份可以呼叫的工具清單。系統還需要一條由服務端執行的治理邊界，用來決定某個憑證目前可以發現哪些能力、讀取哪些資料，以及寫入請求應如何被審查與執行。

OpenPort 透過感知授權的工具發現、作用域與屬性策略檢查、草稿優先寫入、高風險操作的 preflight 與重放保護、機器可處理的穩定失敗語義、速率限制及結構化稽核事件來定義這條邊界。參考執行環境與一致性驗證工具，則使這些治理要求能夠跨模型與智能體執行環境被實際執行和檢驗。

英文摘要

AI agents increasingly require direct, structured access to application data and actions, but production deployments still struggle to express and verify the governance properties that matter in practice: least-privilege authorization, controlled write execution, predictable failure handling, abuse resistance, and auditability. This paper introduces OpenPort Protocol (OPP), a governance-first specification for exposing application tools through a secure server-side gateway that is model- and runtime-neutral and can bind to existing tool ecosystems. OpenPort defines authorization-dependent discovery, stable response envelopes with machine-actionable agent.* reason codes, and an authorization model combining integration credentials, scoped permissions, and ABAC-style policy constraints. For write operations, OpenPort specifies a risk-gated lifecycle that defaults to draft creation and human review, supports time-bounded auto-execution under explicit policy, and enforces high-risk safeguards including preflight impact binding and idempotency. To address time-of-check/time-of-use drift in delayed approval flows, OpenPort also specifies an optional State Witness profile that revalidates execution-time preconditions and fails closed on state mismatch. Operationally, the protocol requires admission control (rate limits/quotas) with stable 429 semantics and structured audit events across allow/deny/fail paths so that client recovery and incident analysis are deterministic. We present a reference runtime and an executable governance toolchain (layered conformance profiles, negative security tests, fuzz/abuse regression, and release-gate scans) and evaluate the core profile at a pinned release tag using artifact-based, externally reproducible validation.

核心貢獻

  1. 01

    協定契約

    定義與模型和執行環境無關的工具發現及呼叫介面，包括端點、回應封裝、工具中繼資料與穩定的 agent.* 原因碼。

  2. 02

    受治理的執行路徑

    將整合憑證、作用域與 ABAC 風格策略約束，同草稿優先寫入、preflight 影響綁定、冪等性、可選 State Witness、速率限制和結構化稽核結合起來。

  3. 03

    可執行驗證

    將規範與參考執行環境、分層一致性設定、負向安全測試、模糊及濫用回歸測試和發佈門禁配套交付。

證據與適用範圍

本文目前是 arXiv v1 預印本，其驗證對象是在 v0.1.0 標籤下最小參考執行環境所呈現的協定不變量。論文並未宣稱該最小執行環境已具備生產就緒性；當時仍有部分增強控制處於部分覆蓋或後續工作階段，生產部署還需要持久化治理狀態、分散式准入控制及經過強化的領域適配器。

引用本文

建議使用 DOI 作為穩定引用。下方 BibTeX 記錄對應本頁面標示的 arXiv 版本。

Zhu, G., Wang, C., Wang, Z., Li, Z., & Li, Q. (2026). OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2602.20196

@misc{zhu2026openport,
  title         = {{OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access}},
  author        = {Zhu, Genliang and Wang, Chu and Wang, Ziyuan and Li, Zhida and Li, Qiang},
  year          = {2026},
  month         = feb,
  eprint        = {2602.20196},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR},
  doi           = {10.48550/arXiv.2602.20196},
  url           = {https://arxiv.org/abs/2602.20196},
  note          = {arXiv:2602.20196v1}
}