What is this?
OpenAPPA is a deterministic guardrail layer that sits between an AI agent and its tools, checking every tool call to decide whether the data involved is allowed to reach that destination.
OpenAPPA is a deterministic guardrail layer that sits between an AI agent and its tools, checking every tool call to decide whether the data involved is allowed to reach that destination.Is this a library, a proxy, or something else?It can run in-process as a library, as a sidecar process, or at the LLM proxy level, depending on how you integrate it with your agent.
It can run in-process as a library, as a sidecar process, or at the LLM proxy level, depending on how you integrate it with your agent.How do I try this out?The fastest way is the Claude Code integration: start a protected session and run the policy setup skill to watch the policy engine make decisions on real work.
The fastest way is the Claude Code integration: start a protected session and run the policy setup skill to watch the policy engine make decisions on real work.What do I need to define before it can enforce anything?You need a declarative TOML policy file describing permissions; the engine evaluates purely from the event log with no network or file calls.
You need a declarative TOML policy file describing permissions; the engine evaluates purely from the event log with no network or file calls.Is this stable enough for production yet?No — it is explicitly labeled a preview and RFC, meaning the config and wire protocol may still break without backward-compatible shims.
No — it is explicitly labeled a preview and RFC, meaning the config and wire protocol may still break without backward-compatible shims.Which coding agents and tools are supported beyond Claude Code?Archestra's 1.4 Release Candidate implements OpenAPPA for Claude Code, Claude Desktop, Cursor, Codex, OpenCode, Copilot CLI, n8n, and any other agent that talks through an LLM proxy.
Archestra's 1.4 Release Candidate implements OpenAPPA for Claude Code, Claude Desktop, Cursor, Codex, OpenCode, Copilot CLI, n8n, and any other agent that talks through an LLM proxy.Does the policy engine need network access to make decisions?No — the engine decides purely from the local event log and makes no network or file calls, so decisions are reproducible.
No — the engine decides purely from the local event log and makes no network or file calls, so decisions are reproducible.How is OpenAPPA different from classifier-based or PII-detection guardrails?Classifiers and PII detectors are probabilistic and can vary between runs, while OpenAPPA's check is deterministic and returns the same decision every time given the same event log.
Classifiers and PII detectors are probabilistic and can vary between runs, while OpenAPPA's check is deterministic and returns the same decision every time given the same event log.How good are the benchmark results compared to alternatives?Across 1,320 evaluations on Bench-Corp and AgentThreatBench, OpenAPPA blocked 100% of scored attacks while completing 89% of tasks, versus Claude Auto mode (90% completion, 10% attacks succeeded) and Microsoft FIDES (41% completion, 31% attacks succeeded).
Across 1,320 evaluations on Bench-Corp and AgentThreatBench, OpenAPPA blocked 100% of scored attacks while completing 89% of tasks, versus Claude Auto mode (90% completion, 10% attacks succeeded) and Microsoft FIDES (41% completion, 31% attacks succeeded).How can I test policy changes before merging?The APPA CLI provides 'appa describe --check' to validate your configuration loads, and 'appa replay' to check scripted tool calls against expected decisions; these can be wired into a required CI check via GitHub Actions.
The APPA CLI provides 'appa describe --check' to validate your configuration loads, and 'appa replay' to check scripted tool calls against expected decisions; these can be wired into a required CI check via GitHub Actions.What is APPA?APPA (Agentic Permissions Policy Algebra) is the formal algebra powering OpenAPPA, published in a paper accepted to the NeurIPS 2026 Workshop on Agents in the Wild, that provides recoverable information-flow control guarantees for LLM agents.
APPA (Agentic Permissions Policy Algebra) is the formal algebra powering OpenAPPA, published in a paper accepted to the NeurIPS 2026 Workshop on Agents in the Wild, that provides recoverable information-flow control guarantees for LLM agents.What are similar projects?strix, nono, lean-ctx, trustmebro, casbin-gateway, agent-beacon, 0, nordef-matrix-open-control
strix, nono, lean-ctx, trustmebro, casbin-gateway, agent-beacon, 0, nordef-matrix-open-controlWhich topics is it in?policy-engine, toml, agent-security, guardrails, n8n, llm-security, access-control, ai-security, github-actions, sandbox, ci, cursor
policy-engine, toml, agent-security, guardrails, n8n, llm-security, access-control, ai-security, github-actions, sandbox, ci, cursor