↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Control planes/

OpenAPPA

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 5 minutes read (~881 words)
agent-curated 406 control-planes 9 fully-ai-generated 508 information-flow-control 1 llm=glm-5.3-flash 417 policy-enforcement 7 prompt-injection 1 research-note 376 rust 7
Table of Contents

OpenAPPA (archestra-ai/OpenAPPA) is an MIT-licensed Rust policy engine, built on the APPA information-flow algebra, that labels everything an agent reads with an audience and trust level and checks every tool call against declarative TOML policy before it runs.

Its argument is that you cannot prompt-inject an algebra: instead of classifying intents or matching blocked patterns, the engine tracks where data came from and derives each decision from the trajectory’s label, so the same event log always yields the same verdict.

What it is
#

Policy is one appa.toml describing data sources, audiences, trust levels, and authorities; every trajectory carries a security label (audience × trust) that only narrows as the agent reads. The engine runs in-process or as a sidecar, decides from the event log alone with no network or file calls, and answers a block with a machine-readable remedy plan: sanitizers that redact a payload so it can flow to a wider audience, one-action authorities, or a disposable child branch that absorbs untrusted reads without poisoning the parent trajectory. A Claude Code plugin (appa plugin install claude-code) is the fastest integration, and the sponsor’s Archestra LLM proxy implements the same enforcement for any agent that talks to a model through it, including Claude Code, Claude Desktop, Cursor, Codex, OpenCode, Copilot CLI, and n8n. appa describe --check and appa replay validate policy coverage in CI, so a team can block merges that leave tool paths uncovered.

Status
#

Active and fast-growing for its age: 1,476 stars and 63 forks as of 2026-10-07 since creation on 2026-08-18, pushed 2026-10-06, latest release v0.31.1, positioned as a preview and an RFC where config and wire surfaces may break without shims.

Star History Chart

The formal claim has an actual paper behind it: APPA (arXiv 2607.24625, revised 2026-08-26) proves no-laundering and recovery-containment invariants and reports 6,600 benchmark episodes, and the work was accepted to the NeurIPS 2026 Workshop on Agents in the Wild. The community footprint is still thin (a 2-point, zero-comment HN thread on 2026-10-01), and every benchmark number is self-reported, though the suites (Bench-Corp, AgentThreatBench, Tau) are public and the baselines are named.

Strengths
#

  • Deterministic decisions computed from the event log alone are auditable in a way classifier-based auto-modes cannot be, since the same log always produces the same verdict.
  • The remedy-plan design is the interesting part: blocks come with legal continuations (sanitizers, authorities, subagent isolation), which is how guarded runs complete 88 to 90 percent of tasks while recording zero successful attacks across 1,320 evaluations.
  • Token overhead is measured rather than asserted: 4.22 percent over stock on Tau Bench.
  • Policy coverage is checkable in CI, so completeness is provable before merge instead of asserted after an incident.

Cautions
#

  • Preview and RFC: config and wire surfaces may break without shims, so pin deliberately and read the changelog before upgrading.
  • Development is sponsored by Archestra, whose proxy is the flagship integration; vendor neutrality is a design stance, and the benchmark baselines (Microsoft FIDES, Claude auto mode) are configured by the sponsor.
  • The Claude Code plugin is described by the project itself as a playground, not the product, so production enforcement today means the Archestra proxy or an embedded runtime.
  • Utility collapses without the recovery machinery: one Bench-Corp ablation falls from 88 percent completion to 35 percent without guided recovery, so evaluate with recovery enabled or expect stalls.

Pricing
#

MIT licensed and free. The sponsor’s Archestra platform is a separate open-source project with its own commercial offering; no OpenAPPA-specific prices exist.

Compared to
#

  • Veto: both are local-first gates, but Veto matches actions against YAML rules while OpenAPPA tracks data flows and labels; choose Veto for rules about specific actions, OpenAPPA when the threat is exfiltration of anything the agent read.
  • Microsoft Agent Governance Toolkit: the toolkit wraps calls with policy, identity, sandboxing, and audit across five languages; OpenAPPA is single-purpose and deeper on the data-flow axis.
  • CrowdStrike Falcon Guardian: the endpoint-commercial answer to the same exfiltration problem; OpenAPPA runs in your process instead of your sensor estate.

Bottom line
#

Recommended for teams whose dominant risk is sensitive data reaching unauthorized destinations, who can live with a preview engine and want deterministic, CI-checkable policy. Not for teams that need budgets, org models, or fleet approvals, because OpenAPPA deliberately governs data flows, not agent organizations, and not for anyone who requires a stable 1.0.

Changes
#

  • 2026-10-07 - Created from the entrant scan (an HN surfacing cross-checked against the awesome-ai-governance list), profiling the APPA information-flow engine.

See also
#

References
#