OpenAPPA: deterministic flow-label guardrails that don't break agents
Open-source MIT guardrail tracks audience×trust labels across tool calls (algebra, not LLM-as-judge), returns remedy plans (sanitize/authority/subagent) so agents keep ~90% task completion with 0% exfil on their benches—plugs via pre/post tool hooks; docs also as MCP.