Sentinel Runtime sits in the execution path of AI and agent actions. It reads the consequence of each action from the action's own parameters, spends validation effort in proportion, decides before anything runs, and writes a signed attestation whether the answer is yes, no, or ask a human.
Every consequential action passes through the same five stages. The action never reaches its target until a disposition has been recorded, and the record exists whether the action ran or not.
The proof dimensions are the same in every domain; only the checks inside them are configured to the system under validation. Together they answer whether an action is permitted, justified, uncompromised, and compliant — and the attestation names which checks produced each answer.
Scope and limits read from the parameters, not the permission: amounts against thresholds, row counts against mass-update limits, windows against retention rules, destinations against allow-lists, the blast-radius tier itself, and the escalation path that applies when a limit is crossed.
Every action must trace to an authorized instruction — an operator, a case, a schedule, a ticket — and the stated rationale must cover the scope requested. For automated decisions, attribution, counterfactual stability and confidence are checked, and independent evaluators must agree.
The signatures of compromise: injected instructions in retrieved documents, tickets or memory; repeat patterns and deviation from an actor's baseline; tool-description drift against a pinned manifest; adversarial inputs; and stability of the decision under perturbation and missing data.
The action is mapped to the customer's policy and the frameworks that apply — NIST AI RMF, ISO/IEC 42001, DoD Responsible AI, EEOC, sector rules — and to the registries that make policy concrete: counterparties, sharing agreements, sensitive locations, hotlists, model identities and data lineage.
All capabilities are delivered through pilot engagements, scoped to one system and operated with our team.
An agent with write access to a database can update one row or drop the table on the same permission. Thorough validation costs a model inference, and systems that apply it uniformly get switched off. Sentinel Runtime reads the consequence from the arguments of this invocation and spends effort accordingly.
| Invocation | Cardinality | Tier | Depth | Disposition |
|---|---|---|---|---|
| Read one row by primary key | 1 | T0 | rules only · 0 model calls | permit |
| Read a concrete file | 1 | T0 | rules only · 0 | permit |
| Update one row by primary key | 1 | T1 | 1 dimension · 1 | permit |
| Email a single recipient | 1 | T2 | 2 dimensions · 2 | permit |
| Email 400 recipients | 400 | T3 | full inspection · 5 | escalate |
| Transfer $9,500 | 1 | T3 | full inspection · 5 | escalate |
| DELETE with no predicate | unbounded | T3 | full inspection · 5 | block |
| DELETE induced by retrieved content | unbounded | T3 | full inspection · 5 | block |
Rows one and seven are the same tool with the same permission. A permission system sees one capability; the gate sees a difference of three tiers and orders of magnitude in validation cost.
On a synthetic workload, proportional allocation reduced model invocations by 44% against uniform deep inspection while every high-consequence action still received full treatment. Repeated invocations that match a prior assessment are served from cache with no model calls. Tiers and depths shown are illustrative defaults from the reference implementation; a customer's policy sets its own.
Policies are versioned files the customer owns: limits, allow-lists, approval roles, prohibited categories, and the tier thresholds themselves. Change a limit and the next action is validated against the new version, with the version number in its attestation. Unknown tools default to the highest tier, so nothing escapes by being unrecognized.
Policies reference registries rather than embedding them — approved counterparties, sharing agreements, sensitive locations, pinned tool manifests — so the operational data can be maintained by the people who own it without touching the policy.
policy: treasury-v3 applies_to: [treasury.transfer, wallet.sign_and_send] limits: single_transaction_usd: 250000 daily_outflow_usd: 2000000 approval_above_usd: 250000 → role: finance-ops require: counterparty_in: registry.approved_counterparties instruction_origin: operator # not retrieved content rationale_traces_to: [invoice, schedule] resilience: injection_signatures: enabled repeat_pattern_window: 30d tiers: T0: blast_radius < 5 T1: 5 – 12 T2: 12 – 20 T3: ≥ 20 # full inspection on_block: notify [finance-ops, security] on_escalate: route finance-ops, timeout 4h → block attest: always
Sentinel Runtime is a gate, not a dashboard. It receives a proposed action, returns a disposition and an attestation, and the caller executes only on permit. Four ways to put it in the path; none of them modify the model, the prompts, or the tool servers.
Proxy any Model Context Protocol server. The gateway reads the server's tool list to populate its registry, validates every invocation in transit against a scoped manifest, and passes permitted calls through unchanged. Zero dependencies; wraps a server without modifying it.
Wrap tool functions in Python or TypeScript with one decorator per consequential action. Arguments are assessed before the function body runs; blocked calls raise and are routed to review.
Run alongside an existing agent framework — LangGraph, CrewAI, AutoGen, in-house — receiving proposed actions over a local API. No change to model or prompts.
For wallets and treasury agents: validation runs before a transaction is signed, with calldata simulation and allow-list checks, so nothing irreversible is authorized without a disposition.
The gate ships in monitor mode. Every action is assessed, validated and attested, and every action is released, until enforcement is switched on. Run it inline for a reporting period, read the shadow report — what would have been escalated, what would have been blocked, and why — calibrate the policy against real workload, then enable enforcement tier by tier. It cannot break anything until you tell it to.
Shadow report · 14 days · monitored, 0 enforced tier share mean ms model calls T0 61.2% 0.08 0 T1 19.5% 0.41 1 T2 11.8% 1.52 2 T3 7.5% 74.90 5 would permit 84.1% would escalate 11.6% → finance-ops 9.2% · sre-lead 2.4% would block 4.3% → injection 2.1% · scope 1.7% · counterparty 0.5%
Every disposition produces a canonical record: subject, assessment, the result of every check that ran, the decision, the routing, and the latency. It is hashed, chained to the previous record, and signed with a key the customer holds. A single record cannot be altered without breaking the chain, and a missing record is detectable because the sequence has no gaps.
Identities and sensitive subjects are pseudonymized at the point of recording, so attestations can be shared with auditors and aggregated into public reports without exposing who was involved. The verifier is open source under BSD-3, so checking our evidence never requires a licence from us. Full attestation methodology →
Generate and verify one in the console →{
"version": "1.0",
"attestation_id": "att-9f2e41",
"issued_at": "2026-09-02T14:03:11Z",
"subject": {
"agent": "finance-ops-agent / run 4187",
"action": "treasury.transfer",
"policy": "treasury-v3"
},
"assessment": { "blast_radius": 18.0, "tier": "T2", "checks_run": 20 },
"dimensions": { "pog": "PASS", "poe": "FAIL", "por": "FAIL", "poc": "PASS" },
"findings": [
"poe:Rationale traceability",
"por:Injection signatures",
"por:Agent triangulation"
],
"status": "BLOCKED",
"routing": "human_review:finance-ops",
"latency_ms": 661,
"prev": "sha256:5b3e19c0…a91c",
"digest": "sha256:e02c7f4b…3d18",
"signature": { "alg": "Ed25519", "key_id": "cust-2026-09", "value": "…" }
}
A finding from research becomes a runtime control; a runtime decision becomes an audit record; a method from Labs becomes a check in the engine.
Pre-execution assurance for agent actions, tool calls, workflows and automated decisions. This page.
Managed AI red teaming, private researcher programs and continuous adversarial testing, with findings that become runtime policy.
Technical reports, taxonomies and reference implementations — and the methodology behind the evidence.
A pilot starts in monitor mode on your highest-risk actions. In four to six weeks you have a shadow report, a calibrated policy, enforcement on the tiers you choose, and an attestation log you can verify yourself.