OpenAPPA: Recoverable Information-Flow Control for Real-World LLM Agents

OpenAPPA is an early-stage, open-source policy engine that checks agent tool calls outside the model’s control loop, aiming to prevent private or untrusted data from flowing to unauthorized destinations without simply blocking the whole task.

Its APPA model tracks both who may receive data and how trustworthy that data is. Policies are declarative TOML; the engine checks actions before dispatch and can isolate untrusted reads in disposable child branches, returning only constrained results. The research paper describes formal safety properties and a dual evaluation for security and task completion. The authors report zero successful attacks across 1,320 guarded episodes and 88–90% task completion, but these are project-reported benchmark results, not an independent security audit. The repository labels the implementation a preview and RFC, so expect the interfaces to change.

InfoQ has no reader-comment thread for this report. The linked research paper and implementation are the best places to inspect the model and reproduce the claims.

• APPA research paper
• OpenAPPA repository and benchmarks