AI agents are transitioning from isolated assistants to heterogeneous systems where multiple agents, planners, controllers, and execution backends operate within the same user or enterprise environment. In such settings, safety becomes a system‑level action‑governance problem: deciding whether concrete agent‑generated actions should be committed before they modify shared state. Existing safeguards only cover prompts, tool calls, GUI actions, and agent‑local behavior, often leaving enforcement fragmented, obscuring cross‑step risks, and offering limited auditability and policy evolution support.
OpenAgentFlow introduces a control‑plane/action‑plane architecture that enforces safety at the action‑commit boundary. It normalizes pending GUI actions, API calls, tool calls, and LLM‑generated invocations into a unified AgentEvent stream, routes each event through a shared pre‑execution Policy Enforcement Point (PEP), and keeps provenance, session state, audit records, and updatable policies in the control plane. This creates a governable shared action stream, allowing new rules to take effect without modifying agents, prompts, models, or execution paths.
When instantiated on Android, OpenAgentFlow achieved 94.0% accuracy and a 95.3% attack block rate on a 300‑case action‑event benchmark. On a 30‑case dynamic‑policy suite, it matched expected behavior in 27 cases after installing new rules. Across 98 traced cases from a 100‑case Android emulator suite, raw accuracy reached 90.8% and trace‑adjusted pass rate rose to 92.9%, covering GUI, API, and LLM‑planned scenarios.
These results demonstrate that OpenAgentFlow provides a practical shared enforcement boundary for heterogeneous AI agent fleets, enabling system‑wide safety governance.
Review: OpenAgentFlow proves that a unified action‑commit boundary can effectively deliver system‑level safety for diverse agent fleets, and its strong performance on Android validates its real‑world applicability.