Retrieved article excerpt
Open article · Retrieved 2026-09-28T15:45:17.840409+00:00
# What is OpenAPPA
How to sing “OpenAPPA”
OpenAPPA is a frontier deterministic AI guardrail that is 100% resistant to data exfiltration caused by prompt injection or model hallucination, and the first of its kind that doesn't break agents.
It is open, vendor-agnostic, and MIT-licensed.
And yes, it outperforms competitors on benchmarks:
Task completion
OpenAPPA89%
Claude Auto mode90%
FIDES (Microsoft)41%
Attacks that succeeded
OpenAPPA0%
Claude Auto mode10%
FIDES (Microsoft)31%
[Read the full benchmark results →](https://www.openappa.com/evaluation)
## Non-deterministic guardrails miss the problem[#](https://www.openappa.com/#non-deterministic-guardrails-miss-the-problem)
The industry's answer to approval fatigue is a second model that judges each tool call: Claude Code's auto mode, Codex's auto-review, and other [auto-modes](https://www.openappa.com/openappa-vs-auto-mode).
By design, they cannot track data flow across tool calls. Because classifiers are prompt-injectable themselves, harnesses hide tool outputs from them, so the judge never sees the data at all.
Because of their probabilistic design, even the best top out at [99.3%](https://openai.github.io/openai-guardrails-python/ref/checks/prompt_injection_detection/): at millions of calls, 0.7% is a lot of breaches.
## Other deterministic guardrails either break agents or don't work[#](https://www.openappa.com/#other-deterministic-guardrails-either-break-agents-or-dont-work)
Blacklisting commands against an LLM is a dead end. Block `rm -rf /` and the model writes a Python one-liner; block `curl` and it pushes to an external git remote. A list of regexes also gives zero visibility into coverage: nobody can verify that it closes every path, or that three mundane tools chained together don't leak.
Rule sets end up either so tight they break the agent or so intricate nobody can audit what they permit.
## OpenAPPA tracks flows instead of matching patterns[#](https://www.openappa.com/#openappa-tracks-flows-instead-of-matching-patterns)
OpenAPPA is a cross-platform, pluggable engine driven by a [single configuration](https://www.openappa.com/contracts). It runs outside the agent's prompt and execution loop, so the model cannot see, negotiate with, or manipulate it, and it [plugs into an existing agent loop](https://www.openappa.com/add-to-agent) in one place.
appa.tomlversion = 2[[tool]]delta = { … }requires = { … }Coding AgentsLLM ProxiesMCP GatewaysMCP ServersAgents in Production
Instead of allowed and blocked tools, the configuration describes data sources, [audiences](https://www.openappa.com/contracts#audiences), [trust levels](https://www.openappa.com/contracts#trust), and [authorities](https://www.openappa.com/contracts#authorities). Every trajectory carries a security label, `audience × trust`: reading a private repo narrows the audience, reading an unvetted web page lowers trust. The label only ever gets more restrictive, and the engine derives each decision from it algebraically.
An injected prompt telling the agent to leak secrets is irrelevant: you cannot prompt-inject an algebra. Because the configuration is declarative, you can [validate in CI/CD](https://www.openappa.com/validation) that your whole tool graph is covered. The configuration is data-specific, so you can scale to millions of agents without changing it.
## It's full of tricks to help agents accomplish their tasks[#](https://www.openappa.com/#its-full-of-tricks-to-help-agents-accomplish-their-tasks)
Strict enforcement is where utility usually dies: a bare "forbidden" makes an agent stall, retry, and fail. OpenAPPA instead returns a machine-readable [remedy plan](https://www.openappa.com/how-it-works#keeping-agents-useful-under-restrictions) with the ways the agent may legally proceed:
- **Sanitizers** transform the payload, masking secrets or redacting PII, so it can flow to a wider audience. Stock sanitizers ship in the box; custom ones, including model-based ones, plug in with a clear blast radius.
- **Authorities** approve one specific action, through a human or an internal API, without lifting the session's restrictions for later calls.
- **Subagents** isolate an untrusted read in a disposable branch, so the parent trajectory continues unpoisoned.
This is what lifts task completion from 37% to 90% on our [benchmarks](https://www.openappa.com/evaluation) and makes deterministic security practical.