OpenAgentFlow introduces a decoupled control-plane architecture designed to mitigate "composed risk" in multi-agent systems, where individually safe actions combine to create hazardous outcomes like data exfiltration. Unlike traditional defenses that rely on localized prompt filters or per-tool guardrails, OpenAgentFlow implements a system-wide governance layer inspired by network engineering. The architecture bifurcates operations into an Action Plane, which normalizes diverse inputs—including GUI interactions, API calls, and Python functions—into a unified AgentEvent stream, and a Control Plane that manages updatable FlowRules and session-level provenance. Enforcement occurs at a Policy Enforcement Point (PEP) positioned at the "action-commit boundary" via a four-tier evaluation pipeline: T1 (Structured Rules), T2 (Payload/Provenance), T3 (Semantic Assessment), and T4 (Final Adjudication). This tiered approach optimizes latency by resolving most actions at the initial stages. Empirical evaluations using the TS-Bench benchmark demonstrate significant efficacy, achieving a 97.62% accuracy and a 96.59% unsafe-action recall on the AgentDojo-Traj split, while maintaining a low 1.96% safe false-intervention rate. By leveraging session-level provenance, the system can detect multi-step attacks, such as indirect prompt injections that redirect data through various agents, without requiring modifications to the agents' underlying models or prompts.