A gate in front of your agents
Every agent action, ruled before it runs.
Your agent says what it wants to do. Sentinel checks your rules first and answers: allow, review, or block. When in doubt, it says no.
git clone https://github.com/nsfwsabir/Sentinel.git && cd Sentinel
docker compose up --build -d
Dashboard :3000 · API :3001 · wire a judgment provider to judge
research-agent · send_email { to: external@example.com, attachment: customers.csv } → dec_e1bf234d
Real screens from our own test setup. It cycles through them on its own. Hover to pause, pick a tab, tap the stamp to slam it again, tap the picture to zoom.
Try it
Try the exact decision your agent would get.
The same examples as inside the product. Pick one, press Evaluate, open the ruling. Nothing really runs.
Checked against the code: the first three pass, the last one gets blocked. No model needed for that call.
How it decides
How a ruling gets made.
Same four steps, every single time.
- 01Your agent asks firstBefore it sends, deletes, or pays anything, it tells Sentinel who it is and what it wants to do.
- 02Your hard rules run firstCustomer files going outside? Deleting production? Over the $100 limit? Plain code settles those on the spot. A block here ends it.
- 03A model weighs the gray areasFor the rest, the provider you wired in answers five plain yes-or-no questions. It advises. It never decides.
- 04You get an answer with reasonsAllow, review, or block, with the why attached. Reviews sit tight until a person rules. It all lands in a log nobody can quietly rewrite.
JUDGMENT_PROVIDER=laya · LAYA_API_KEY stays on your server
A human breaks ties
Unsure means a person decides. Never an auto-yes.
A $250 refund beats the $100 limit, so it waits its turn. Someone you trust presses Approve or Reject. That press gets logged too.
Proof
Every ruling leaves a trail you can check.
Real numbers from our test setup: 24 rulings, 7 blocked, 1 waiting, 16 allowed. And anyone can ask Sentinel to re-check its own log, top to bottom.
The why, spelled out
What it tried, which rules matched, what the model said, and the reason. The whole story on one screen.
A log you can check
Ask for a verification any time. Even after old entries are cleaned up, signed checkpoints still prove the chain.
Quiet when it matters
Can't reach the model? Risky stuff gets blocked, the rest waits. A broken answer is never treated as a yes.
The exfil that never sent.
send_email { to: external@example.com, attachment: customers.csv }
It tried to mail the customer file outside. Two of your rules caught it, so nothing sent. The reason sits on the record.
Questions
Answers before you self-host.
Sentinel plays it safe. Dangerous stuff gets blocked, the rest waits for a person. A failed answer is never taken as a yes, and the stumble gets logged.
As little as possible. The decision, which rules matched, and redacted notes. Full payloads with sensitive bits stay out by default.
It means waiting on a person. It sits in the queue until someone approves or rejects it. Nothing continues on its own, and the call gets logged.
Real passwords and secrets instead of the dev ones, encrypted traffic in front, and backups of the database. The app refuses to run properly until the dev defaults are gone.
Not an agent, not a cure-all dashboard, not a safety guarantee. It is the checkpoint between your agent and the tools it wants to use.
MIT · your infra · your keys
Put a gate in front of your agents.
Clone it, start it, open Simulate. Plug in Laya, OpenAI, Decision-1, or Jev when ready. The models advise. Your rules decide.
docker compose up --build -d → localhost:3000 → Simulate → Evaluate
every action, before execution