Default-deny authorization
Rust checks identity, signed contracts, expiration, arguments, exact resource scope, Cedar policy, and approval requirements. A failure does not fall back to unguarded execution.
AI Security / Cybersecurity / Systems Engineering
Sentinel AI
Your agent can propose. Only policy can permit.
Sentinel AI (SentinelOS) is an open-source research project and release candidate: a local-first gateway that authorizes supported AI agent actions independently of the model. It is a security runtime, not an operating-system kernel.
01 / The problem
A proposal is not permission.
Agents process instructions and untrusted content in the same workflow. Relying on the model to enforce its own permissions leaves a gap between what it proposes and what it should be allowed to do.
The engineering goal is to put authorization in a separate, testable boundary: trusted task contracts, resource permissions, policies, and human approvals govern supported operations before execution.
02 / System design
Policy before execution
The Python SDK routes supported requests through the Rust gateway. The model can propose a tool call; it cannot grant itself authority.
- 01AI agentProposes an action
- 02Tool requestTyped action + arguments
- 03Sentinel gatewaySignature, scope & expiry
- 04Policy evaluationDefault-deny Cedar rules
- 05DecisionALLOW / DENY / REQUIRE APPROVAL
- 06Restricted toolOnly after authorization
DENY stops execution. REQUIRE APPROVAL pauses for an authenticated, action-bound approval and re-evaluation. Only an authorized request reaches a restricted tool.
Illustrative workflow—not a live security decision.
Local enforcement, optional observation
SQLite records runtime audit events. A local administration dashboard handles approvals and revocation. Optional local LLM integration proposes bounded actions. Opt-in Workers/D1 telemetry is observational: cloud services cannot approve local tools or modify trusted contracts.
03 / Engineering decisions
Make the boundary explicit
Approvals that cannot be reused
Authenticated human approvals bind to the exact task, action, and request body. Expiration, one-time use, and task revocation limit stale or replayed authority.
A deliberately narrow executor
Supported Unix file tools use descriptor-pinned access within a private directory. Wasmtime runs a fixed, import-free checksum component with memory, fuel, and deadline limits.
Agent integration without model trust
The Python SDK separates proposals from trusted authorization. Experimental protected-data flow rules constrain later sinks; they do not provide general semantic tracking or complete prompt-injection protection.
Operational visibility
SQLite audit logging and the local dashboard expose actual runtime decisions. The implementation challenge is keeping observation, approval authority, and restricted execution separate—even when optional cloud synchronization is unavailable.
04 / Verification evidence
Tested boundaries, stated scope
- Rust and Python regression checks passed on Ubuntu, macOS, Windows Server 2022, and Windows Server 2025 in the linked GitHub Actions run.
- Candidate artifact builds passed for macOS Apple Silicon, macOS Intel, Linux x86-64, and Linux ARM64. A successful build does not establish every native platform security property.
- Documented macOS Apple Silicon and Linux ARM64 installer tests covered checksums, installation, real gateway execution, overwrite refusal, uninstall, and tamper rejection.
- Local browser and cloud integration evidence covers synthetic identities and local Workers/D1 workflows; it does not establish production OAuth readiness.
Evidence reviewed 14 October 2026. Recent CI runs supersede older documentation about unrun CI; security boundaries below remain unchanged. These are project records, not tests rerun for this portfolio.
05 / Security boundaries
What the project does not claim
This is a research release candidate, not an independently certified security product. It governs supported tools integrated through the gateway—not arbitrary agents, shell commands, or unrestricted Python execution.
- Prompt-injection impact containment is experimental; complete protection is not claimed.
- The trusted controller, host administrator, and build chain remain in the trust boundary.
- The Wasm boundary covers the fixed component, not the entire Python process.
- Native Windows filesystem isolation is not verified; successful Windows regression jobs do not change that limitation.
- Production cloud authentication and hosted security configuration require further verification.
- Candidate builds are not a promise of published installers. Consult the project website and repository for release availability.