SENTINEL Default-deny authorization
A request is denied unless its authenticated task contract and policy authorize the operation and resource. Model confidence never substitutes for authority.
SECURITY CONTROLS
Enforcement beyond
the prompt.
A composable local runtime for supported agent tools. Each control has an explicit scope and a testable outcome.
Signed, expiring task contracts
Trusted controllers issue task-scoped authority. Agent-generated instructions cannot modify signatures, permissions or expiration.
Human approvals and replay protection
Sensitive authorized operations can require a local authenticated approval. Approvals bind to the exact request and can be consumed only once. The cloud cannot issue them.
Revocation and audit correlation
Local task revocation stops the runtime. SQLite records decisions and execution metadata so proposals, authorization and actual execution can be distinguished.
Restricted execution
Simulated APIs have no production connectivity. Unix descriptor-pinned file tools and a fixed, bounded Wasm tool provide deliberately narrow execution capabilities.
Prompt-injection impact containment
Malicious tool content remains untrusted. Gateway restrictions still apply when a model follows hostile instructions. This is not a claim of detection or complete immunity.
Experimental provenance controls
Protected observations can mark a task and block subsequent sinks. This conservative research mechanism is not complete information-flow tracking.
Optional private telemetry
Only explicitly allowed event metadata may leave the device. Cloud outages do not change local authorization; cloud events are endpoint reports, not tamper-proof evidence.