Archestra, an open-source enterprise AI platform that bundles guardrails, an MCP registry, a gateway and an orchestrator, shipped version 1.4.0 "Arpa" on October 21, 2026. The GitHub release notes list 86 pull requests for the headline change: OpenAPPA guardrails replace the old guardrails, alongside a remote agent runtime, new access control and redesigned connection flows for coding agents. The release reached Hacker News as "Archestra 1.4: OpenAPPA and Self Hosted Runtime for Claude Code and Codex".
This post summarizes the release for teams running agents in a company, flags the breaking changes, and puts it in context with the other controls we have covered. The notes are terse, so where we cannot verify a detail we say so. We have not run the release.
TL;DR
| Area | What changed in 1.4.0 |
|---|---|
| Guardrails | OpenAPPA replaces the old guardrails: policy as text, batteries per provider, human review from chat tools and coding agents, yells, break-the-glass, policy validations, GitHub/GitLab sync, consult log |
| Agent runtime | New remote runtime: hand work from laptop to runtime and back; files and conversation survive between turns; Slack progress and needs-input pings |
| Access control | Per-object grants (View, Use, Edit, Full) replace visibility scopes; multiple roles, team inheritance, SSO default roles |
| Connect | Redesigned page, script-first installers, new clients (OpenCode, Kilo Code, Claude Desktop), managed instructions, admin-decided model routing |
| Chat ops | Slack: one bot per agent, streamed replies, native Stop, router bot; Teams keeps context in 1:1 and group chats |
| Service accounts | Replace team and org gateway tokens, auto-migrated with same token values |
| LLM proxy | Bill keys to a team with spend caps; cost explorer; several OpenAI-compatible endpoints on one key |
| Breaking | Legacy guardrails and Dual LLM removed; two feature flags removed |
OpenAPPA guardrails
The release describes the new guardrails as "policy as text": instead of configuring tool-invocation and trusted-data rules, administrators write a policy in natural language that checks agent actions. The notes list:
- Batteries per provider. Provider-specific support so the policy checks work across LLM providers.
- Human review answered from anywhere. A reviewer can approve or deny from chat, Slack, Teams, Telegram, Claude Code, Codex and OpenCode.
- Yells. A way to report a bad block. The commit log shows a "yell reporting enabled by default" change.
- Break-the-glass. Turns guardrails off for the session, an escape hatch for false positives that also needs governance.
- Policy validations, GitHub/GitLab sync and a consult log. Policies can be reviewed in Git, and decisions are logged.
What the notes do not explain is how OpenAPPA decides: the checks appear to be model-based ("APPA" checkpoints at the LLM proxy, per commit titles), which means they inherit the weaknesses of classifier-style monitors. Anthropic's recent study found production blocking monitors missed over 55% of attacks from a persistent adversarial agent, including prompt injection of the monitor and multi-context attacks. A text-policy guardrail should be treated the same way: useful against over-eager mistakes, not a substitute for sandboxing and scoped credentials.
The remote agent runtime
"New Remote Agent Runtime. Hand work off laptop to runtime and back. Files and native conversation survive between turns." The runtime replaces the earlier Jobs model with durable Agent Sandbox workspaces, per the commit list, and the breaking-changes note says the runtime now auto-detects the Agent Sandbox controller. Slack gets progress updates and "needs input" pings, and commits mention preserving sessions across client handoffs and Claude Code and Codex support.
For teams, the appeal is running long agent tasks on shared infrastructure instead of someone's laptop, with the ability to take them back. The risks are the standard ones for hosted agents: credentials stored in the runtime, network egress, and what the agent can reach. The commit titles include credential unification across Agent Runtime, MCP and GitHub integrations, egress rules for runtime pods, and fixes for Claude subscriptions, so these areas are active.
RBAC and service accounts
Per-object grants (View, Use, Edit, Full) replace visibility scopes. Users can hold multiple roles, teams inherit, and SSO can set default roles. Ownership transfer was extended to skills, plugins, projects, apps and connections. Separately, service accounts replace the old team and org gateway tokens. The notes say they are auto-migrated with the same token values, which avoids breakage but also means existing tokens keep working under a new model, so rotate them if you suspect exposure.
LLM proxy, logs and costs
- Bill keys to a team with spend caps, plus a cost explorer.
- Several OpenAI-compatible endpoints on one key.
- A session trace page showing MCP tool calls in a waterfall with guardrail checks inline.
- A metadata-only log mode, useful where prompts cannot be stored.
For teams comparing gateways, see our look at the open-source Rust AI gateway Respan and the Cloudflare AI gateway. Note OpenAI's new rule that routers and gateways need approval from November 20; if you front OpenAI models with a gateway such as this one, check how that applies to your setup.
Other additions
- Git integration for skills, plugins and policy sync with GitHub and GitLab, cloud and self-hosted, GitHub Apps only.
- Plugins generally available.
- A2A outbound delegation, so external agents can act as subagents.
- Knowledge bases with personal and team sharing and rendered multi-site crawling.
- About 60 performance PRs on page loads, chat cold start and agent lists, plus a search palette, pinning and a new agent creation flow.
Breaking changes and upgrade checklist
| Change | Action |
|---|---|
| Legacy tool-invocation and trusted-data policies removed | Rewrite them as OpenAPPA policies before upgrading |
| Dual LLM removed | Replace with OpenAPPA checks or another control |
| ARCHESTRA_OPENAPPA_ENABLED and ARCHESTRA_AGENT_RUNTIME_ENABLED removed | Remove from your configuration |
| Runtime auto-detects Agent Sandbox controller | Verify the controller is installed in your cluster |
| Visibility scopes replaced by per-object grants | Review migrated permissions |
| Team and org gateway tokens replaced by service accounts | Confirm migrated tokens and rotate if needed |
Back up your database, test in staging, and read the full notes on the project's release page and repository.
What teams will ask before adopting
Is it free and self-hosted? The project is open source on GitHub and the release is titled for a self-hosted runtime; the notes mention Helm upgrade paths, database migrations and Kubernetes pieces, so expect to run it in your own cluster. Licensing and any commercial tier are on the repository, which we did not audit.
Does it replace my coding agent? No. It sits in front of Claude Code, Codex, OpenCode and similar clients, managing connection, instructions, model routing and policy. The Connect page installs and configures those clients, with "managed instructions that auto-refresh at launch," which lets an admin push a rule set to every developer.
What does "model routing decided by admins" mean in practice? Central control over which models developers' agents may call, which is also how spend caps and the cost explorer become enforceable. It overlaps with the gateway category, which is why OpenAI's new approval rule for routers is relevant.
How mature is it? The release is a minor version that went through 13 betas and 15 release candidates, and the legacy policy engine was removed outright. That suggests fast iteration. Test the migration carefully and avoid enabling break-the-glass broadly.
Where is the weak spot? Anything that relies on a language model to judge another model's action can be attacked by crafting the action so that it looks benign, as the Anthropic study documents. Layer sandboxing, least-privilege credentials and audit review underneath.
Who should look at this release
| Team | Why |
|---|---|
| Security or platform teams rolling out Claude Code or Codex company-wide | Central policy, logs and spend control |
| Teams that want human approvals in Slack or Teams | Review answered from chat tools |
| Organizations with existing Archestra deployments | Breaking changes require a planned migration |
| Individuals or small teams | Likely heavier than needed; start with the agent's own permission modes |
Why it matters
Companies adopting Claude Code and Codex at scale have a governance gap: individual developers connect agents with personal subscriptions and local config, and security teams cannot see or control tool use. Platforms like Archestra aim to centralize connection, policy, audit and cost. This release moves that effort toward policy written in plain language and review from the tools people already use, which lowers friction but raises the question of how reliable text-based checks are. For related approaches, see how Walmart's Agent Gateway uses agent profiles and spending limits, how MCP rug-pull and tool poisoning scanners work, and our roundup of MCP servers. For an independent runtime layer, AgentBeam from the explainx.ai team stops AI agents before they take dangerous actions.
Related reading
- Anthropic red-teaming Auto Mode and Codex Guardian
- OpenAI usage policies: routers and gateways need approval
- Respan: open-source Rust AI gateway
- Walmart Agent Gateway and agent profiles
- MCP rug-pull and tool poisoning explained
- Top MCP servers, open and closed source
- Official: Archestra 1.4.0 release notes · Archestra repository
Based on the release notes of October 21, 2026; we did not run the software.