OpenAgentFlow: How a Control-Plane Architecture Brings System-Wide Safety to Multi-Agent AI

OpenAgentFlow is a new approach to ensuring system-wide safety in multi-agent AI environments. As AI agents become more interconnected, the safety problem becomes more complex, as individual agents can combine to create unsafe outcomes. The OpenAgentFlow architecture proposes a control-plane design borrowed from network engineering to govern agent actions at a system level.

The architecture consists of two planes: the Action Plane, which captures every interaction an agent makes, and the Control Plane, which holds updatable policies and enforces them. The Policy Enforcement Point (PEP) sits at the action-commit boundary, where it runs a four-tier evaluation pipeline to decide whether to allow or block an action. The session-level provenance model allows the PEP to see the entire session's state, enabling it to detect composed attacks that would be invisible to per-action filters.

The OpenAgentFlow system achieved high accuracy and recall rates in various test suites, including controlled, AgentDojo-Traj split of TS-Bench, and threat suites. Its ability to govern actions across GUI, API, and LLM-planned channels simultaneously makes it a promising solution for ensuring system-wide safety in multi-agent AI deployments.