The usual answer to keeping agents in line is a second model that judges each tool call. Archestra argues that approach cannot work, and has released an engine that sidesteps it.
OpenAPPA runs outside the agent’s prompt and execution loop, so the underlying model cannot inspect or negotiate with the rules. Policies live in a single configuration file that names data sources, audiences, trust levels and authorities.
The design tracks what data flows where. Reads tighten the allowed audience, unvetted web pages lower trust, and labels can only grow more restrictive. When an agent attempts an illegal action, the engine halts dispatch and offers a route forward: sanitize the payload, send the request for human approval, or confine a risky read to a throwaway branch.
On two benchmarks covering enterprise workflows and the OWASP agentic threats, the team reports no successful attacks and an 89 percent task completion rate. Claude Code’s auto mode allowed 10 percent of attacks with 90 percent completion. Microsoft FIDES let 31 percent through at 41 percent completion.
Turning off the recovery plans dropped completion to 35 percent, which the authors read as proof the escape hatches matter. OpenAPPA is in preview.
