Sentinel SCA is built to help teams verify agent identity, evaluate actions before execution, preserve tenant-scoped evidence, and review operational activity with traceable governance records.
Read Buyer Brief Validation Summary Developer DocsSee the validated governance controls and the execution proof and evidence behind this security boundary.
| Area | Current Implementation |
|---|---|
| Cryptographic identity | Ed25519 agent keys with generated keypair and customer-provided public key enrollment. |
| Signed governance | Signed agent requests are verified before Sentinel records a governance decision. |
| Governance signing authority | Live responses, decision records, and capability evidence use one Ed25519 authority and key ID. AWS KMS Ed25519 custody support is implemented and deployment-ready; each tenant claim depends on that deployment being configured and smoke-verified. |
| Tenant isolation | Users, agents, audit events, evidence exports, and billing state are scoped by organization. |
| Replay-aware controls | Timestamp and signature checks reduce stale or duplicated request risk. |
| Audit integrity | Governance decisions include hashes, timestamps, and exportable evidence context. |
| Billing security | Paddle webhook signatures are enforced before subscription lifecycle changes are processed. |
| Readiness | /health, /live, and /ready support deployment and monitoring checks. |
Agents must be known and cryptographically verifiable before governed actions are accepted.
Customer audit timelines and evidence ZIP exports stay bound to the authenticated organization.
Owner, admin, auditor, and viewer roles separate management access from evidence-only access.
Unsigned or invalid Paddle webhooks are rejected before entitlement state can change.
Global protocol freeze, readiness checks, and request IDs support incident response.
Architecture, API docs, tenant isolation tests, SLA draft, and DR docs are available for review.
Sentinel treats its governance signing key as a critical production asset. The runtime fails closed when the configured signing provider is missing, malformed, unsupported, or not valid for the active environment.
Live responses, integrity records, and capability evidence resolve to the same public key and key ID.
Runtime secret injection remains available as a migration path, but production use is refused unless an explicit temporary override is documented.
AWS KMS Ed25519 signing is implemented behind the provider boundary so private key material stays outside the Sentinel process once configured.
S3 Object Lock evidence storage support is implemented and enabled per customer deployment with bucket, retention, legal hold, and IAM verification.
Public metadata: response verification key and signing posture.
Sentinel claims non-exportable KMS custody only for deployments configured with SENTINEL_RESPONSE_SIGNING_PROVIDER=aws_kms, a real AWS KMS Ed25519 key, correct IAM, published key metadata, and passing environment smoke evidence.
| Item | Status |
|---|---|
| Protocol runtime | Operational |
| Tenant isolation smoke coverage | Implemented |
| Paddle webhook signature enforcement | Implemented |
| Customer BYOK agent enrollment | Implemented |
| Unified governance signing authority | Implemented |
| AWS KMS signing custody | DEPLOYMENT-READY — AWS KMS Ed25519 provider support is implemented and enabled per deployment after key, IAM, region, public metadata, and smoke verification. |
| S3 Object Lock evidence storage | DEPLOYMENT-READY — S3 Object Lock provider support is implemented and enabled per deployment after bucket, retention, legal-hold, and IAM verification. |
| Dedicated CloudHSM / FIPS Level 3 custody | Contract-scoped; not self-serve. |
| Third-party security audit | PLANNED — Third-party security audit is planned. |
| SOC 2 / ISO 27001 | ROADMAP — SOC 2 and ISO 27001 are roadmap items; Sentinel does not claim current certification. |
For security review, enterprise evaluation, or responsible disclosure, contact Sentinel SCA through the contact flow.
Contact Sentinel SCA Watch Guided Demo