Agentao: Governable Agent Systems

Overview

Agentao is an embeddable Python runtime for building agents that use tools, retain state, and interact with host applications. This series follows one request through sessions, SDK or ACP boundaries, Tools, Skills, MCP, hooks, permissions, confirmation, sandboxes, networks, tenant isolation, persistence, observability, budgets, and rollout. Its thesis is that the model proposes, Agentao mediates, and the host plus infrastructure enforce identity, business authorization, execution limits, and evidence. The result is a practical way to choose boundaries and test systems across interactive, IDE, ticket, data, and unattended workloads. Agentao supplies governance mechanisms, not a complete product or automatic security guarantee; deployment-specific controls and first-party documentation limits still require host-side validation.

Learning outcomes

Agentao makes agent authority visible, but the host still owns identity and business authorization.
Tools execute capabilities; Skills shape behavior; MCP connects external services; hooks intervene at lifecycle points.
Permissions and confirmation gate proposals, while OS, network, credential, and tenant controls constrain execution.
Reliable deployments persist the right state, serialize sessions, observe outcomes, cap resources, and close what they open.

Keywords

AgentaoGovernancePermissionsPythonACPToolsIsolationSkillsMCPSandboxes

Chapters

Agentao Runtime Governance

Separate model guidance from enforceable authority

12 min · Separate model guidance from enforceable authority

12 min

Agentao Session Lifecycle

From prompt assembly to state, concurrency, and cleanup

12 min · From prompt assembly to state, concurrency, and cleanup

12 min

Agentao SDK, ACP, or Both

Choose by language, isolation, state, and failure ownership

14 min · Choose by language, isolation, state, and failure ownership

14 min

Agentao Capability Design

Match each surface to its responsibility

13 min · Match each surface to its responsibility

13 min

Agentao Authority Map

Trace capability, policy, execution, and evidence

10 min · Trace capability, policy, execution, and evidence

10 min

Agentao Permission Gate

Order rules, confirmations, and trust conservatively

12 min · Order rules, confirmations, and trust conservatively

12 min

Agentao Security Boundaries

Where prompts end and infrastructure begins

13 min · Where prompts end and infrastructure begins

13 min

Agentao Runtime Reliability

Restore state, observe behavior, and bound resources

14 min · Restore state, observe behavior, and bound resources

14 min

Agentao Production Architecture

Match boundaries and controls to the product

16 min · Match boundaries and controls to the product

16 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-9 Premium

FAQ

What does Agentao govern, and what remains the host’s responsibility?

Agentao coordinates sessions, tools, skills, permissions, memory, protocols, and events; the host still enforces identity, business authorization, deployment policy, and product behavior.

Should a host embed Agentao with the Python SDK or use ACP?

Use the Python SDK for direct, stateful Python integration; use ACP for language independence, process isolation, or separated dependencies, and use a hybrid when a narrow specialist task justifies another boundary.

Why are prompts and permission rules not enough to secure Agentao?

They shape and gate model proposals, but filesystem, network, credential, tenant, API, and OS boundaries must independently limit what an allowed tool can reach.

How should a production Agentao host keep sessions reliable?

Persist structured messages and active skills under current policy, serialize turns, set separate time and resource budgets, observe stable lifecycle events, and close resources during eviction or shutdown.