OpenAPPA 是一种前沿的确定性 AI 防护栏，宣称可 100% 抵御因提示注入或模型幻觉导致的数据外泄，并且是首个不会破坏 Agent 的同类方案。

它是开放的、厂商无关的，并采用 MIT 许可证。

是的，它在基准测试中的表现优于竞争对手：

阅读完整基准测试结果 →

非确定性防护栏遗漏了问题#

面对“审批疲劳”，行业给出的答案是使用第二个模型来评判每一次工具调用：Claude Code 的自动模式、Codex 的自动审查，以及其他自动模式。

从设计上说，它们无法跨工具调用追踪数据流。由于分类器本身也可能遭受提示注入，运行框架会向它们隐藏工具输出，因此判定模型实际上根本看不到数据。

由于采用概率性设计，即使最好的方案最高也只能达到 99.3%：在数百万次调用中，0.7% 意味着大量泄露事件。

其他确定性防护栏要么破坏 Agent，要么不起作用#

针对 LLM 将命令列入黑名单是一条死路。封禁 rm -rf /，模型就会写出一行 Python；封禁 curl，它就会推送到外部 Git 远程仓库。正则表达式列表同样完全无法提供覆盖范围的可见性：没有人能够验证它是否封堵了每一条路径，也无法确认三个看似普通的工具串联后不会发生泄露。

规则集最终要么严格到破坏 Agent，要么复杂到没有人能审计其允许的行为。

OpenAPPA 追踪数据流，而非匹配模式#

OpenAPPA 是一个跨平台、可插拔的引擎，由单一配置驱动。它运行在 Agent 的提示词和执行循环之外，因此模型无法看到、协商或操纵它；并且只需在一个位置即可将其接入现有 Agent 循环。

toml

appa.toml

version = 2

[[tool]] delta = { … } requires = { … }

Coding Agents

LLM Proxies

MCP Gateways

MCP Servers

Agents in Production

配置不再描述允许和禁止的工具，而是描述数据源、受众、信任等级和权限。每条轨迹都携带一个安全标签：audience × trust。读取私有仓库会缩小受众范围，读取未经审核的网页会降低信任等级。该标签只会变得更加严格，而引擎会以代数方式从中推导每一个决策。

一条要求 Agent 泄露秘密的注入式提示词无关紧要：你无法对代数进行提示注入。由于配置是声明式的，你可以在 CI/CD 中验证整个工具图是否都被覆盖。配置是数据特定的，因此你可以扩展至数百万个 Agent，而无需修改配置。

它提供了许多帮助 Agent 完成任务的机制#

严格执行通常意味着可用性的终结：简单地返回“禁止”会让 Agent 停滞、重试并最终失败。OpenAPPA 则会返回机器可读的补救计划，说明 Agent 可以通过哪些合法方式继续执行：

• **脱敏器（Sanitizers）**会转换载荷，对秘密进行掩码处理或删减 PII，因此数据可以流向更广泛的受众。内置提供常用脱敏器；也可接入自定义脱敏器，包括基于模型的脱敏器，并且其影响范围明确。
• **权限（Authorities）**可通过人工或内部 API 批准某一项特定操作，而不会解除该会话后续调用的限制。
• **子 Agent（Subagents）**会在一次性分支中隔离不受信任的读取操作，使父轨迹能够在未受污染的状态下继续运行。

这正是其在我们的基准测试中将任务完成率从 37% 提升至 90%，并使确定性安全措施具备实用价值的原因。

OpenAPPA is a frontier deterministic AI guardrail that is 100% resistant to data exfiltration caused by prompt injection or model hallucination, and the first of its kind that doesn't break agents.

It is open, vendor-agnostic, and MIT-licensed.

And yes, it outperforms competitors on benchmarks:

Task completion

OpenAPPA89%

Claude Auto mode90%

FIDES (Microsoft)41%

Attacks that succeeded

OpenAPPA0%

Claude Auto mode10%

FIDES (Microsoft)31%

Read the full benchmark results →

Non-deterministic guardrails miss the problem#

The industry's answer to approval fatigue is a second model that judges each tool call: Claude Code's auto mode, Codex's auto-review, and other auto-modes.

By design, they cannot track data flow across tool calls. Because classifiers are prompt-injectable themselves, harnesses hide tool outputs from them, so the judge never sees the data at all.

Because of their probabilistic design, even the best top out at 99.3%: at millions of calls, 0.7% is a lot of breaches.

Other deterministic guardrails either break agents or don't work#

Blacklisting commands against an LLM is a dead end. Block rm -rf / and the model writes a Python one-liner; block curl and it pushes to an external git remote. A list of regexes also gives zero visibility into coverage: nobody can verify that it closes every path, or that three mundane tools chained together don't leak.

Rule sets end up either so tight they break the agent or so intricate nobody can audit what they permit.

OpenAPPA tracks flows instead of matching patterns#

OpenAPPA is a cross-platform, pluggable engine driven by a single configuration. It runs outside the agent's prompt and execution loop, so the model cannot see, negotiate with, or manipulate it, and it plugs into an existing agent loop in one place.

appa.tomlversion = 2[[tool]]delta = { … }requires = { … }Coding AgentsLLM ProxiesMCP GatewaysMCP ServersAgents in Production

Instead of allowed and blocked tools, the configuration describes data sources, audiences, trust levels, and authorities. Every trajectory carries a security label, audience × trust: reading a private repo narrows the audience, reading an unvetted web page lowers trust. The label only ever gets more restrictive, and the engine derives each decision from it algebraically.

An injected prompt telling the agent to leak secrets is irrelevant: you cannot prompt-inject an algebra. Because the configuration is declarative, you can validate in CI/CD that your whole tool graph is covered. The configuration is data-specific, so you can scale to millions of agents without changing it.

It's full of tricks to help agents accomplish their tasks#

Strict enforcement is where utility usually dies: a bare "forbidden" makes an agent stall, retry, and fail. OpenAPPA instead returns a machine-readable remedy plan with the ways the agent may legally proceed:

• Sanitizers transform the payload, masking secrets or redacting PII, so it can flow to a wider audience. Stock sanitizers ship in the box; custom ones, including model-based ones, plug in with a clear blast radius.
• Authorities approve one specific action, through a human or an internal API, without lifting the session's restrictions for later calls.
• Subagents isolate an untrusted read in a disposable branch, so the parent trajectory continues unpoisoned.

This is what lifts task completion from 37% to 90% on our benchmarks and makes deterministic security practical.