Sentinel

Sentinel is an open-source, self-hostable runtime policy gate for AI agents. Before an agent sends, deletes, or pays anything, it asks Sentinel, which checks the action against deterministic rules and returns ALLOW, REVIEW, or BLOCK. It is released under the MIT license and runs on the user's own infrastructure.

What It Is

Sentinel sits between an agent and the tools it wants to use. It is a checkpoint, not an agent, and the project states it is not a safety guarantee. An agent submits its identity, the tool and the arguments, for example through POST /v1/actions/evaluate, an MCP stdio server, or an A2A gateway. Sentinel returns a ruling with the reasons attached.

How a Ruling Gets Made

Deterministic checks run first, using OPA-WASM Rego with a TypeScript fallback. They cover exfiltration, credentials, destructive production actions and payment thresholds. A blocking finding stops evaluation immediately without a model call. For the remaining gray areas, a configured judgment provider answers five schema-validated yes/no questions. These answers are advisory only. Decisions follow the precedence BLOCK > REVIEW > ALLOW, and failures or outages fail closed according to tool risk.

Human Review and Audit Trail

REVIEW decisions never resolve automatically. They wait in an approvals queue until a person approves or rejects, and that action is logged. Every decision is SHA-256 hash-chained, and retention purges leave signed Ed25519 checkpoints. The chain can be re-verified through GET /v1/audit/verify. The dashboard includes a Simulate page for trying preset scenarios, a decision detail view and an overview of blocked, waiting and allowed counts.

Setup Path

Self-hosting uses Docker Compose, which starts Postgres, Redis, the API, the dashboard and an optional Falco kernel-signals component that needs a privileged Linux host. The dashboard runs on port 3000 and the API on port 3001. Judgment providers include a default mock, Laya, OpenAI, Microsoft Decision-1 via OpenRouter, and any System-One-wire endpoint. Custom providers can be registered. Production boot refuses the dev default credentials.