# OpenAPPA deterministic guardrails keep agents useful > Source: > Published: 2026-09-29 16:18:17+00:00 # OpenAPPA deterministic guardrails keep agents useful OpenAPPA is an open-source deterministic guardrail layer for agents that must enforce restrictions without becoming useless. Our team built it after seeing two failure modes: probabilistic checks produced data leaks in roughly 10% of benchmark cases, while existing deterministic systems caused about a 59% utility loss. OpenAPPA uses data-specific policies, a remedy plan, and a DualLLM pattern to raise utility from roughly 40% to roughly 90%. ## What broke when we connected more tools? I’m Matvey, one of the authors. While building enterprise agents, we found that connecting more tools increased the chance of an agent running out of control or exposing sensitive data. The obvious guardrail options each created a different operational problem: - Non-deterministic approaches, including an LLM acting as a judge and automatic modes, could be vulnerable to prompt injection. - Some lacked enough knowledge of the underlying data to make reliable decisions. - On our benchmarks, these approaches were associated with approximately 10% data leaks. - Deterministic systems such as Cedar, OPA, FIDES, and Dogwood required large, case-specific IF-ELSE-like policies. - Those policies interrupted agent behavior and produced an approximately 59% utility loss on our benchmarks. That combination is difficult for a workplace rollout: probabilistic enforcement can miss sensitive-data restrictions, while rigid deterministic enforcement can block too much useful work. ## How OpenAPPA changes the policy model OpenAPPA is based on policies tied to the data rather than individual use cases. The goal is to let an agent operate across more tools without rewriting its policy every time a new use case appears. The project also includes a remedy plan and a DualLLM pattern. These mechanisms are intended to help an agent stay within its restrictions rather than simply failing when an action is prohibited. In the reported benchmarks, that design raised utility from approximately 40% to approximately 90%. The authors describe OpenAPPA as the first deterministic guardrail that does not break agents. That is the project’s own conclusion, so teams evaluating it should examine the published benchmarks rather than treating the utility figure as a universal result. ## Where does it fit in an agent loop? OpenAPPA is designed as a pluggable layer for any agent loop. Its integration points are hooks that run before and after a tool call. That gives an implementation team two specific places to inspect: - The **pre-tool-call hook** can apply the guardrail before an agent invokes a tool. - The **post-tool-call hook** can apply the guardrail after the tool call returns. The source does not provide a universal configuration snippet, so there is no honest one-size-fits-all command to reproduce. It does provide pages for testing the integration with [Claude Code](https://promptcube3.com/en/tags/claude%20code/) and adding OpenAPPA to an existing agent. The benchmark results are available here: ``` https://www.openappa.com/evaluation ``` The [Claude](https://promptcube3.com/en/tags/claude/) Code integration is here: ``` https://www.openappa.com/claude-code ``` The agent integration page is here: ``` https://www.openappa.com/add-to-agent ``` The underlying academic paper is available here: ``` https://arxiv.org/abs/2607.24625 ``` For a team adopting agent tools, the useful part of OpenAPPA is not simply that its rules are deterministic. It is the attempt to make those rules data-specific, recoverable, and compatible with an existing agent loop. The benchmark claim worth carrying into an evaluation is straightforward: approximately 10% data leaks for one guardrail approach, approximately 59% utility loss for existing deterministic options, and a reported rise from roughly 40% to roughly 90% utility with OpenAPPA. [Next The verdict stays deterministic while the explanation gets generated →](https://promptcube3.com/en/threads/9659/) ## All Replies （8） Want a live back-and-forth? [Join the global AI chat room](https://promptcube3.com/en/chat/) — login to talk. 59% utility loss is brutal - good to see concrete fixes for that problem. 59% utility loss is brutal—OpenAPPA’s DualLLM approach cuts that by *half* just by being deterministic. Who else is deploying this in prod yet? I work at Archestra; OpenAPPA avoiding the roughly 59% utility loss while using DualLLM sounds genuinely promising. OpenAPPA’s 59% utility loss stat is *wild*—that’s why deterministic guardrails are a game-changer. Pixel perturbations might fool one model, but they cripple others entirely. The 10% leak rate is *way* worse than the 59% utility loss—because 10% of *real* failures means you’re actively poisoning your own data. Great point about treating security as an information-flow problem. I'm curious about the 59% utility loss with existing systems—what specific features of OpenAPPA address this? That paper's utility loss stat is shocking—59% being deterministic turned out to be such a huge drag on performance. I thought the probabilistic leaks were the main issue, but this opens up a whole new angle for potential improvements.