Deterministic security for real-world agentic applications.
Website · How it works · Policy reference · Benchmarks · Paper · Discord
OpenAPPA sits between an agent and its tools and answers one question before every action: is this data allowed to go to this destination?
It is powered by APPA — Agentic Permissions Policy Algebra — which tracks the sensitivity and trust of everything an agent reads and checks every outbound call against it. Checks run before dispatch, so sensitive data never reaches an unauthorized tool. Classifiers and PII detectors are probabilistic; a declared flow decision here holds on every run, which is what it takes to trust an agent around medical or financial records.
Policy is declarative TOML, and the engine is a pure decision core — a function of the event log, no IO — so it embeds inside your own agent: in-process from Rust or Python, or as a sidecar every step is checked against. Broader coverage across those surfaces is the active work.
Agent security has to be measured on two axes at once: an agent that permits unauthorized flows is unsafe, and an agent that refuses valid work is useless. Bench-Corp — multi-step enterprise workflows across HR, finance and support — with GPT-5.6 Luna, 35 episodes per arm:
| Prompts | Policy arm | Task completion | Attack success | Security pass |
|---|---|---|---|---|
| Standard | OpenAPPA | 94.3% | 0% | 100% |
| FIDES | 28.6% | 22.9% | 77.1% | |
| Unprotected | 74.3% | 28.6% | 71.4% | |
| ChaosMonkey (adversarial) | OpenAPPA | 91.4% | 0% | 100% |
| FIDES | 28.6% | 28.6% | 71.4% | |
| Unprotected | 65.7% | 28.6% | 71.4% |
The full 104-sample AgentThreatBench
comparison — stock, permissive, guarded OpenAPPA and Microsoft FIDES — lives in
bench/agentthreatbench.
Methodology, TAU-bench and AgentThreatBench results: Benchmarks.
The Claude Code plugin is a playground for the model, not the product. It is the fastest way to watch a policy make a decision on real work:
claude plugin marketplace add archestra-ai/OpenAPPA &&
claude plugin install appa-runtime@appa &&
claude "set up APPA"This installs a clappa command that runs Claude Code protected by OpenAPPA;
plain claude sessions stay untouched. Run /appa-tool-sync in a plain
claude session to bring your MCP servers into the policy, then start clappa
to try the protected flow.
Setup, upgrade and uninstall: Claude Code
integration ·
integrations/claude-code.
OpenAPPA is a preview and an RFC. The model is settled enough to build against and deliberately open to argument — config and wire surfaces may break without shims. Read the paper, then open an issue — or come argue in the Discord.