OpenPort 协议：AI 代理工具访问的安全治理规范
OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access
AI总结：
OpenPort 协议通过安全治理规范实现AI代理工具访问的可控性和安全性，提供风险门控生命周期、授权模型和审计机制。
摘要：
AI 代理越来越多地需要直接、结构化的应用程序数据和操作访问，但生产部署仍难以表达和验证实践中重要的治理属性：最小特权授权、受控写执行、可预测的失败处理、抗滥用性和可追溯性。本文介绍了 OpenPort 协议（OPP），一种以治理为核心的规范，用于通过安全的服务器端网关暴露应用程序工具，该规范与模型和运行时无关，并能绑定到现有的工具生态系统。OpenPort 定义了授权依赖的发现、具有机器可操作 agent.* 原因代码的稳定响应封装，以及结合集成凭证、受限权限和 ABAC 风格策略约束的授权模型。对于写操作，OpenPort 指定了一个风险门控的生命周期，默认为草稿创建和人工审查，支持在显式策略下的时间限定自动执行，并强制执行高风险保障，包括预飞行影响绑定和幂等性。为了解决延迟批准流程中时间检查/时间使用漂移问题，OpenPort 还指定了一个可选的 State Witness 配置文件，重新验证执行时的前置条件并在状态不匹配时失败关闭。操作上，该协议要求准入控制（速率限制/配额）具有稳定的 429 语义，并在允许/拒绝/失败路径上跨结构化审计事件，使客户端恢复和事件分析确定性。我们提出了一个参考运行时和一个可执行的治理工具链（分层符合性配置文件、负安全测试、模糊/滥用回归和发布门扫描）并在固定发布标签上使用基于制品的、可外部重现的验证评估核心配置文件。
英文摘要：
AI agents increasingly require direct, structured access to application data and actions, but production deployments still struggle to express and verify the governance properties that matter in practice: least-privilege authorization, controlled write execution, predictable failure handling, abuse resistance, and auditability. This paper introduces OpenPort Protocol (OPP), a governance-first specification for exposing application tools through a secure server-side gateway that is model- and runtime-neutral and can bind to existing tool ecosystems. OpenPort defines authorization-dependent discovery, stable response envelopes with machine-actionable \texttt{agent.*} reason codes, and an authorization model combining integration credentials, scoped permissions, and ABAC-style policy constraints. For write operations, OpenPort specifies a risk-gated lifecycle that defaults to draft creation and human review, supports time-bounded auto-execution under explicit policy, and enforces high-risk safeguards including preflight impact binding and idempotency. To address time-of-check/time-of-use drift in delayed approval flows, OpenPort also specifies an optional State Witness profile that revalidates execution-time preconditions and fails closed on state mismatch. Operationally, the protocol requires admission control (rate limits/quotas) with stable 429 semantics and structured audit events across allow/deny/fail paths so that client recovery and incident analysis are deterministic. We present a reference runtime and an executable governance toolchain (layered conformance profiles, negative security tests, fuzz/abuse regression, and release-gate scans) and evaluate the core profile at a pinned release tag using artifact-based, externally reproducible validation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
