Sentinel SCA is built to help teams verify agent identity, evaluate actions before execution, preserve tenant-scoped evidence, and review operational activity with traceable governance records.
Read Buyer Brief Validation Summary Developer Docs| Area | Current Implementation |
|---|---|
| Cryptographic identity | Ed25519 agent keys with generated keypair and customer-provided public key enrollment. |
| Signed governance | Signed agent requests are verified before Sentinel records a governance decision. |
| Governance signing authority | Live responses, decision records, and capability evidence use one Ed25519 authority and key ID. AWS KMS Ed25519 custody support is implemented and deployment-ready; each tenant claim depends on that deployment being configured and smoke-verified. |
| Tenant isolation | Users, agents, audit events, evidence exports, and billing state are scoped by organization. |
| Replay-aware controls | Timestamp and signature checks reduce stale or duplicated request risk. |
| Audit integrity | Governance decisions include hashes, timestamps, and exportable evidence context. |
| Billing security | Paddle webhook signatures are enforced before subscription lifecycle changes are processed. |
| Readiness | /health, /live, and /ready support deployment and monitoring checks. |
Agents must be known and cryptographically verifiable before governed actions are accepted.
Customer audit timelines and evidence ZIP exports stay bound to the authenticated organization.
Owner, admin, auditor, and viewer roles separate management access from evidence-only access.
Unsigned or invalid Paddle webhooks are rejected before entitlement state can change.
Global protocol freeze, readiness checks, and request IDs support incident response.
Architecture, API docs, tenant isolation tests, SLA draft, and DR docs are available for review.
Sentinel treats its governance signing key as a critical production asset. The runtime fails closed when the configured signing provider is missing, malformed, unsupported, or not valid for the active environment.
Live responses, integrity records, and capability evidence resolve to the same public key and key ID.
Runtime secret injection remains available as a migration path, but production use is refused unless an explicit temporary override is documented.
AWS KMS Ed25519 signing is implemented behind the provider boundary so private key material stays outside the Sentinel process once configured.
S3 Object Lock evidence storage support is implemented and enabled per customer deployment with bucket, retention, legal hold, and IAM verification.
Public metadata: response verification key and signing posture.
Sentinel claims non-exportable KMS custody only for deployments configured with SENTINEL_RESPONSE_SIGNING_PROVIDER=aws_kms, a real AWS KMS Ed25519 key, correct IAM, published key metadata, and passing environment smoke evidence.
| Item | Status |
|---|---|
| Protocol runtime | Operational |
| Tenant isolation smoke coverage | Implemented |
| Paddle webhook signature enforcement | Implemented |
| Customer BYOK agent enrollment | Implemented |
| Unified governance signing authority | Implemented |
| AWS KMS signing custody | Implemented and deployment-ready; enabled per environment after key, IAM, and smoke verification. |
| S3 Object Lock evidence storage | Implemented and deployment-ready; enabled per customer bucket and retention configuration. |
| Dedicated CloudHSM / FIPS Level 3 custody | Contract-scoped; not self-serve. |
| Third-party security audit | Planned for Enterprise readiness |
| SOC 2 / ISO 27001 | Roadmap item, not yet certified |
For security review, enterprise evaluation, or responsible disclosure, contact Sentinel SCA through the contact flow.
Contact Sentinel SCA Watch Guided Demo