01
Agent identity
Ed25519 identity binds each request to a registered, active agent.
The governing question
As autonomous agents move into trading, infrastructure, deployments, customer administration, data access, robotics, and industrial control, capability alone is not enough.
Is this specific action admissible right now, for this agent, tenant, target, policy, risk level, and operational state?
Sentinel evaluates the attempted action before a consequential execution boundary. Customers own their agents, environments, capabilities, policies, and reviewers. Sentinel governs execution.
Decision pipeline
Signed agent request | Identity and tenant verification | Timestamp, replay, and request-integrity checks | Capability and schema validation | Behavior, rate, organization, and entitlement controls | Deterministic policy, sector risk, and reputation evaluation | ALLOW / REVIEW / DENY | Controlled execution or customer-owned human review | Signed response + action hash + ledger + integrity chain | Timeline + replay + evidence bundle + SIEM export
Sentinel fails closed when it cannot establish the conditions required for safe governance.
Thirteen governance layers
02
Tenant isolation
Agent ownership, keys, organization controls, and evidence remain tenant-scoped.
03
Freshness and replay
Timestamp windows, canonical verification, replay tracking, and duplicate detection prevent authority reuse.
04
Capability enforcement
Customer-assigned action and target scopes define what an agent may attempt.
05
Schema validation
Known action types, targets, required fields, and structured values are validated.
06
Execution controls
Organization kill switches, global freeze, and active-agent state can stop propagation.
07
Behavior limits
Plan-aware action windows and sensitive-action limits constrain runaway behavior.
08
Deterministic policy
The active policy returns a bounded decision, reason, and risk score.
09
Sector risk controls
Financial, deployment, data, physical, healthcare, and logistics consequences influence admissibility.
10
Reputation dynamics
Confirmed outcomes adjust agent trust while unresolved reviews remain neutral.
11
Customer human review
Customers decide normal tenant actions; unanswered reviews resolve by risk and fail closed when necessary.
12
Signed integrity
Ed25519 signatures, action hashes, policy versions, and hash-linked records preserve attribution.
13
Replay and evidence
Ledger, timeline, history, verifier scripts, evidence ZIPs, and SIEM exports support independent inspection.
Governance correctness
| Test scenario | Observed result |
|---|---|
| Granted read-only health check | ALLOW at low risk |
| Small approved-symbol trades | ALLOW at bounded risk |
| Medium and large trades | REVIEW |
| Funds movement | REVIEW minimum |
| Funds movement above hard threshold | DENY |
| Staging deployment with matching capability | REVIEW |
| Production deployment without matching target capability | DENY |
| Data deletion with capability | REVIEW |
| Action without required capability | DENY before policy execution |
Missing-capability denials are valid enforcement outcomes, not false positives. In the referenced breadth run, safe actions with valid capabilities had zero observed false-positive escalations.
What validation proved
Signature integrity
Live responses were independently verified. New history records retain the exact canonical signed payload.
Replay and idempotency
Stale or repeated authority is rejected, while idempotent retries return the same governance outcome.
Decision determinism
Equivalent canonical requests produced stable policy outcomes without observed drift.
Reputation behavior
Final outcomes adjust trust. REVIEW remains neutral until approved, rejected, or resolved by timeout.
Concurrency safety
The corrected burst completed 50/50 requests with zero errors at 12.2 observed requests per second.
Evidence portability
Server-generated evidence bundles and generic, Splunk, Elastic, and Microsoft Sentinel exports passed validation.
Customer-owned REVIEW resolution
Normal tenant reviews belong to the customer. Sentinel Ops handles protocol abuse and security exceptions, not routine customer decisions.
| Risk score | No customer response |
|---|---|
| Below 0.40 | Automatic ALLOW |
| 0.40 through 0.80 | Escalate to the customer's security contact, then DENY if unanswered |
| Above 0.80 | Automatic DENY |
Email, signed webhooks, dashboard deadlines, Redis-locked resolution, reputation updates, audit events, and Enterprise review history complete the operational loop.
Observed operational metrics
| Metric | Validation observation |
|---|---|
| Sequential validation | 10/10 successful |
| Sequential latency | Approximately 600 ms per request in the referenced run |
| Concurrent burst | 50/50 successful, 0 errors |
| Observed burst throughput | 12.2 requests per second |
| Full-chain audit sample | 52 records, 0 continuity breaks |
| Live signature sample | 25/25 independently verified |
| Enterprise evidence bundle | HTTP 200, six-file ZIP |
| SIEM formats | 4/4 successful |
These figures are validation observations, not contractual guarantees. Sentinel publishes a 99.9% monthly availability target for contracted Enterprise SLA discussions; measured historical availability requires sufficient production monitoring data.
First-customer integration
Create the customer organization.
Activate the owner account and select plan entitlements.
Create or enroll an Ed25519 agent.
Keep the private key in the customer's execution environment.
Assign scoped capabilities.
Capabilities define what the agent may attempt, not what will execute.
Integrate the production decision path.
Send signed requests to /analyze and verify signed responses.
Configure review notifications.
Set the customer notification email and signed webhook.
Exercise the safety cases.
Validate ALLOW, REVIEW, DENY, replay, idempotency, and timeout behavior in staging.
Verify evidence exports.
Test history, evidence ZIP, verifier scripts, and SIEM output.
Move the execution adapter into production.
Keep downstream execution fail-closed when governance authority is absent or invalid.
Production readiness, stated precisely
The validation demonstrates that Sentinel's core governance runtime is ready for controlled production customer onboarding. Production-ready does not mean finished. It means the safety boundary is coherent, testable, observable, and suitable for a managed deployment process.
Contract- or infrastructure-dependent surfaces such as SSO/SAML, private deployment, multi-region operation, penalty-backed SLA terms, and live KMS/Object Lock tenant configuration remain explicit Enterprise delivery items rather than hidden assumptions. AWS KMS signing custody and S3 Object Lock provider support are implemented and deployment-ready, but tenant claims require environment verification.