OpenAPPA

Hi Hacker News! Matvey, one of the authors, is here.While building enterprise agents, we ran into a problem: the more tools you connect to the AI, the higher the chance it will run out of control and leak sensitive data.Guardrails, in theory, should prevent this, but the situation is worrying: - Non-deterministic guardrails (LLM as a judge, auto modes, etc.) are vulnerable to prompt injections, or they lack knowledge of the data, making them inefficient (~10% data leaks on our benchmarks). - Existing deterministic guardrails (Cedar, OPA, FIDES, Dogwood) require massive case-specific IF-ELSE-like policies and break agents (~59% utility loss on our benchmarks).We did something differently.We’ve taken the best of existing deterministic guardrails and built a policy language that is data-specific, not use-case specific. It lets you scale agents without updating a policy.On top of that, we’ve added multiple tricks (like a remedy plan or a DualLLM pattern) to help agents operate within those restrictions, raising utility from ~40% to ~90% and making it the first deterministic guardrail that doesn't break agents.Finally, we’ve designed it to be pluggable into any agent loop with pre- and post-tool-call hooks.We invite you to check out our benchmarks: https://www.openappa.com/evaluationPlay with it in Claude Code: https://www.openappa.com/claude-codeTry plugging it into your agent: https://www.openappa.com/add-to-agentOr check the academic paper: https://arxiv.org/abs/2607.24625We'd love to hear any feedback!