AI agents are useful because they can read private data, consume untrusted content, and act on the outside world. That combination also makes prompt injection dangerous. Many guardrails ask a second model to judge each tool call, but a judgment on one call cannot reliably track where data came from across an agent's workflow.

In this 10–15 minute lightning talk, I'll introduce OpenAPPA, an open-source, deterministic approach that tracks data provenance and checks tool calls before they run. I'll show how it works with kagent, where agents are Kubernetes resources, then walk through a live demo on kind: an agent encounters an unsafe public GitHub action, the runtime blocks it and offers a remedy, and the agent still completes the legitimate work.

You'll leave with a concrete pattern for making agent guardrails both safe and useful, without putting another LLM in the approval loop.