archestra-ai/OpenAPPA

OpenAPPA – Deterministic Guardrails for LLM Agents

What it is – OpenAPPA (Agentic Permissions Policy Algebra) is a lightweight, deterministic runtime that sits between an AI agent and the external tools it calls. Before each tool invocation it asks a single question: “Is this data allowed to go to this destination?” The decision is made from a declarative policy (written in TOML) and an event log, without any network or file I/O, guaranteeing the same answer for the same inputs.

Why it matters – LLM‑driven agents often read sensitive information (e.g., private emails, meeting recordings) and then invoke tools (APIs, file writes, code execution). Existing guardrails are probabilistic and can either let data leak or block legitimate work. OpenAPPA provides a deterministic, policy‑driven check that prevents unauthorized data flows while preserving high task‑completion rates.

Key components

• APPA engine – evaluates a policy against the current sensitivity/trust level of data and the target tool. Returns a binary allow/deny decision.
• Policy language – simple TOML files describing which data categories (PII, confidential, etc.) may be sent to which destinations (webhooks, repos, cloud services, etc.).
• CLI – appa describe --check validates a policy file; appa replay replays scripted tool calls to verify expected decisions, useful for CI checks.
• Integrations – a plugin for Claude Code, plus a side‑car proxy (Archestra) that can protect any agent that talks to an LLM through an LLM proxy (Claude Desktop, Cursor, Codex, Copilot CLI, n8n, etc.).

Benchmarks – Evaluated on two suites:

• Bench‑Corp (20 multi‑step enterprise workflows) and AgentThreatBench (OWASP Top 10 for agentic apps). In 1,320 runs OpenAPPA blocked 0 % of attacks while completing ~89 % of tasks. Competing systems (Microsoft FIDES, Claude Auto mode) let 31 % and 10 % of attacks through, respectively, and had lower task‑completion rates.

Getting started

# Install the runtime and Claude Code plugin
curl -fsSL https://openappa.com/install.sh | sh && \
  ~/.local/bin/appa plugin install claude-code

# Launch a protected Claude Code session
clappa

You can also embed the APPA runtime directly in your own agent (any language) or run it as a side‑car process that intercepts tool calls.

Typical use cases

• Enterprise agents that handle confidential documents and must enforce data‑flow policies before calling external APIs.
• Development of LLM‑powered assistants where compliance (GDPR, HIPAA, etc.) is required.
• CI pipelines that automatically validate that new policy revisions do not unintentionally block legitimate tool usage.

Status – The project is in preview/RFC mode. The core algebra and recovery guarantees are described in a pre‑print paper (APPA: Recoverable Information‑Flow Control for Real‑World LLM Agents, arXiv 2607.24625) and accepted to the NeurIPS 2026 Workshop on Agents in the Wild. APIs and config formats may change, but the repository is usable for experimentation and integration.

License – MIT.

---

Links

• Website: https://openappa.com
• Paper: https://arxiv.org/abs/2607.24625
• Discord community: https://discord.gg/B5fmSxHKZ7
• Bench‑Corp data: https://github.com/archestra-ai/OpenAPPA/tree/main/bench/corp