A YadriWorks Product

Sentinel-Ops

Enforce AI compliance for agents. Every action an agent takes — running commands, reading files, calling APIs — is checked against your policy before it executes. Safe actions proceed. Dangerous or unauthorized actions are blocked instantly. You define the rules. Sentinel-Ops enforces them.

Getting Started

{
  "agentId": "my-first-agent",
  "version": "1.0.0",
  "identity": {
    "role": "Assistant",
    "authorityLevel": "limited-ops",
    "environmentScope": ["development"],
    "dataClassification": "internal"
  },
  "dataAccess": {
    "readAllow": ["src/**", "docs/**", "config/**"],
    "readDeny": ["**/.env*", "**/credentials*", "**/secrets*"],
    "writeAllow": ["src/**", "docs/**"],
    "writeDeny": ["config/production/**", "**/credentials*"]
  },
  "toolActions": {
    "allowed": ["read_file", "write_file", "search_code"],
    "denied": ["delete_database", "send_email", "transfer_funds"],
    "bash": {
      "allow": ["npm test", "npm run build", "git *"],
      "deny": ["rm -rf *", "sudo *", "curl * | sh", "eval *"]
    }
  },
  "riskBudget": {
    "maxPerSession": 50,
    "thresholds": {
      "warn": 25,
      "throttle": 35,
      "critical": 45,
      "exhausted": 50
    }
  }
}

curl -X POST https://<your-api-endpoint>/v1/deploy \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{"soe": <paste-your-policy-json>}'

curl -X POST https://<your-api-endpoint>/v1/validate \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{"soe": <paste-your-policy-json>}'

docker-soe compose \
  --soe my-agent.soe.json \
  --api-url https://<your-api-endpoint> \
  --token <your-token> \
  my-agent:latest \
| docker compose -f - up

curl -X POST https://<your-api-endpoint>/v1/evaluate \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "agentId": "my-first-agent",
    "toolName": "Bash",
    "toolInput": {"command": "npm test"}
  }'

{
  "decision": "allow",
  "reason": "Bash command matches allow pattern \"npm test\".",
  "layer": "deterministic",
  "agentId": "my-first-agent",
  "toolName": "Bash",
  "timestamp": "2026-03-09T10:15:30.000Z"
}

curl -N https://<your-api-endpoint>/v1/events/stream \
  -H "Authorization: Bearer <your-token>"

The Three Constraints

Every policy is built on three simple rules: who the agent is, what data it can access, and what actions it can take.

{
  "identity": {
    "role": "DevOps",
    "authorityLevel": "deploy-uat-only",
    "environmentScope": ["development", "uat"],
    "dataClassification": "internal"
  }
}

{
  "dataAccess": {
    "readAllow": ["src/**", "docs/**"],
    "readDeny": ["**/.env*", "**/credentials*", "**/secrets*"],
    "writeAllow": ["src/**"],
    "writeDeny": ["src/config/production/**"]
  }
}

{
  "toolActions": {
    "allowed": ["read_file", "search_code", "run_tests"],
    "denied": ["delete_database", "send_email"],
    "bash": {
      "allow": ["npm test", "npm run build", "git *"],
      "deny": ["rm -rf *", "sudo *", "curl * | sh", "eval *"]
    }
  }
}

{
  "bash": {
    "deny": [
      "rm -rf *",
      "sudo *",
      "eval *",
      "curl * | sh",
      "wget * | sh",
      "DROP TABLE *",
      "DELETE FROM *",
      "chmod 777 *"
    ]
  }
}

Risk Budget

The risk budget tracks cumulative risk across an agent's session. An agent that makes 50 borderline calls gets progressively restricted — even if each individual call is allowed.

{
  "riskBudget": {
    "maxPerSession": 50,
    "thresholds": {
      "warn": 25,
      "throttle": 35,
      "critical": 45,
      "exhausted": 50
    }
  }
}

How thresholds work

Risk points

• Read operations: low risk (1–2 points)
• Write operations: medium risk (3–5 points)
• Bash commands: variable (2–10 points depending on the command)
• Denied actions that were attempted: higher risk (the agent is testing boundaries)

Enforcement Modes

Sentinel-Ops supports four modes so you can roll out governance gradually.

Recommended rollout

1. Start with shadow mode for 1–2 days to collect baseline data
2. Switch to audit mode for 1 week to review deny decisions
3. Review the dashboard and tune your policy
4. Switch to enforce mode

Set the mode per-agent in the policy file:

{
  "agentId": "my-agent",
  "mode": "audit"
}

Or globally via environment variable:

SOE_MODE=audit

API Reference

All endpoints require Authorization: Bearer <token> header (except /v1/health).

{
  "agentId": "my-agent",
  "toolName": "Bash",
  "toolInput": {
    "command": "npm test"
  }
}

{
  "decision": "allow",
  "reason": "Bash command matches allow pattern \"npm test\".",
  "layer": "deterministic",
  "mode": "enforce",
  "agentId": "my-agent",
  "toolName": "Bash",
  "timestamp": "2026-03-09T10:15:30.000Z"
}

{
  "agentId": "my-agent",
  "calls": [
    {"toolName": "Bash", "toolInput": {"command": "npm test"}},
    {"toolName": "Bash", "toolInput": {"command": "rm -rf /"}},
    {"toolName": "Read", "toolInput": {"file_path": "src/index.js"}},
    {"toolName": "Read", "toolInput": {"file_path": ".env"}}
  ]
}

{
  "agentId": "my-agent",
  "results": [
    {"decision": "allow", "toolName": "Bash", "reason": "..."},
    {"decision": "deny", "toolName": "Bash", "reason": "..."},
    {"decision": "allow", "toolName": "Read", "reason": "..."},
    {"decision": "deny", "toolName": "Read", "reason": "..."}
  ],
  "summary": {
    "total": 4,
    "allowed": 2,
    "denied": 2,
    "riskUsed": 5,
    "riskMax": 50
  }
}

{
  "soe": {
    "agentId": "my-agent",
    "version": "1.0.0",
    "identity": { "role": "Assistant" },
    "dataAccess": { "readAllow": ["**"] },
    "toolActions": {}
  }
}

{
  "valid": true,
  "errors": [],
  "warnings": [
    "dataAccess.readAllow contains '**' which allows reading all files"
  ]
}

{
  "soe": {
    "agentId": "my-agent",
    "version": "1.0.0",
    "identity": { "role": "DevOps", "authorityLevel": "limited-ops" },
    "dataAccess": { ... },
    "toolActions": { ... }
  }
}

{
  "deployed": true,
  "agentId": "my-agent",
  "path": "my-agent.soe.json"
}

{
  "agentId": "my-agent",
  "toolName": "Bash",
  "toolInput": "npm test",
  "toolOutput": "All tests passed",
  "decision": "allow",
  "sessionId": "session-abc-123"
}

{
  "status": "HEALTHY",
  "version": "1.0.0",
  "timestamp": "2026-03-09T10:00:00.000Z",
  "definitionsCount": 5,
  "authMode": "jwt",
  "judge": { "enabled": true, "running": true }
}

{
  "agents": [
    {
      "agentId": "my-agent",
      "role": "DevOps",
      "authority": "limited-ops",
      "environments": ["development", "uat"],
      "riskState": { "riskUsed": 12, "riskMax": 50, "status": "normal" }
    }
  ],
  "total": 1,
  "page": 1,
  "pages": 1
}

{
  "agentId": "my-agent",
  "riskUsed": 12,
  "riskMax": 50,
  "status": "nominal",
  "totalCalls": 47,
  "deniedCalls": 3,
  "timestamp": "2026-03-09T10:15:30.000Z"
}

curl -N https://<endpoint>/v1/events/stream \
  -H "Authorization: Bearer <token>"

data: {"decision":"deny","agentId":"my-agent","toolName":"Bash","reason":"..."}

{
  "description": "A DevOps agent that can deploy to UAT but not production. Can run Docker and kubectl commands but cannot access secrets or modify infrastructure.",
  "agentId": "my-devops-agent"
}

{
  "soe": { ... },
  "source": "llm",
  "confidence": 0.85,
  "suggestions": [
    "Review deny rules and risk budget before deploying."
  ]
}

{
  "roleArn": "arn:aws:iam::123456789:role/my-agent-role",
  "agentId": "my-agent",
  "tighteningLevel": "conservative"
}

Content Guardrails

In addition to tool call enforcement, Sentinel-Ops includes content guardrails that scan data flowing to and from your AI agent.

POST /v1/guard

Evaluate content against guardrail rules.

Built-in scanners

• PII Detection — SSN, credit card numbers, phone numbers, email addresses
• Prompt Injection — Detects attempts to override agent instructions
• Content Safety — Toxic content, harmful instructions
• Output Validation — Ensures agent outputs conform to expected formats

Event Routing

Sentinel-Ops can route enforcement events to external systems for alerting, SIEM integration, and incident response.

Amazon EventBridge

SOE_EVENT_SINK=eventbridge
SOE_EVENTBRIDGE_BUS=my-event-bus

Events are published with these detail types:

• SOE.ToolAllow
• SOE.ToolDeny
• SOE.ToolEscalate
• SOE.RiskBudgetChange
• SOE.AnomalyDetected
• SOE.EnvelopeTightened

Webhook

SOE_EVENT_SINK=webhook
SOE_WEBHOOK_URL=https://hooks.slack.com/services/...
SOE_WEBHOOK_SECRET=your-hmac-secret

Events are sent as HTTP POST with an X-SOE-Signature header for verification.

Console (CloudWatch)

SOE_EVENT_SINK=console

Events are written as structured JSON to stdout, captured automatically by CloudWatch Logs on ECS.

Multiple sinks

SOE_EVENT_SINK=eventbridge,webhook,console

Event filtering

By default, only deny and escalate events are emitted. To include all events:

SOE_EVENT_FILTER=allow,deny,escalate,anomaly

Best Practices

Policy Examples by Industry

Financial Services

{
  "agentId": "financial-advisor",
  "version": "1.0.0",
  "description": "Provides investment advice. Cannot execute trades or access client PII.",
  "complianceFrameworks": ["sec-finra"],
  "identity": {
    "role": "FinancialAdvisor",
    "authorityLevel": "advisory-only",
    "environmentScope": ["development", "uat", "production"],
    "dataClassification": "confidential"
  },
  "dataAccess": {
    "readAllow": ["market-data/**", "portfolio/summary/**", "reports/**"],
    "readDeny": ["**/ssn*", "**/social-security*", "**/account-number*",
                 "**/credit-score*", "**/credentials*", "**/.env*", "client/pii/**"],
    "writeAllow": ["reports/**", "notes/**"],
    "writeDeny": ["client/**", "trades/**", "accounts/**"]
  },
  "toolActions": {
    "allowed": ["read_market_data", "get_portfolio_summary", "generate_report"],
    "denied": ["execute_trade", "access_client_ssn", "modify_account", "transfer_funds"],
    "bash": {
      "allow": ["curl *api.market*", "python *report*"],
      "deny": ["curl * | sh", "rm -rf *", "DROP TABLE *", "eval *", "sudo *"]
    }
  },
  "riskBudget": {
    "maxPerSession": 20,
    "thresholds": { "warn": 10, "throttle": 15, "critical": 18, "exhausted": 20 }
  }
}

Healthcare (HIPAA)

{
  "agentId": "healthcare-analyst",
  "version": "1.0.0",
  "description": "Analyzes health data. Cannot access PII, PHI, or raw medical records.",
  "identity": {
    "role": "DataAnalyst",
    "authorityLevel": "read-only",
    "environmentScope": ["development", "uat"],
    "dataClassification": "restricted"
  },
  "dataAccess": {
    "readAllow": ["data/**", "reports/**", "research/**"],
    "readDeny": ["**/pii/**", "**/phi/**", "**/ssn*", "**/patient-id*",
                 "**/medical-record*", "**/diagnosis*", "**/credentials*", "**/.env*"],
    "writeAllow": ["reports/**", "analysis-output/**"],
    "writeDeny": ["data/**", "src/**"]
  },
  "toolActions": {
    "bash": {
      "allow": ["python *", "node *report*"],
      "deny": ["rm -rf *", "sudo *", "curl *POST*", "eval *"]
    }
  },
  "riskBudget": {
    "maxPerSession": 30,
    "thresholds": { "warn": 15, "throttle": 22, "critical": 27, "exhausted": 30 }
  }
}

DevOps / SRE

{
  "agentId": "devops-agent",
  "version": "1.0.0",
  "description": "Deploys to dev/UAT. Cannot touch production or infrastructure.",
  "complianceFrameworks": ["soc2"],
  "identity": {
    "role": "DevOpsDeploymentAgent",
    "authorityLevel": "deploy-uat-only",
    "environmentScope": ["development", "uat"],
    "dataClassification": "internal"
  },
  "dataAccess": {
    "readAllow": ["deploy/**", "infrastructure/config/**", "ci-cd/**", "manifests/**"],
    "readDeny": ["**/.env*", "**/credentials*", "**/secrets*", "**/private-keys/**"],
    "writeAllow": ["deploy/uat/**", "deploy/dev/**", "manifests/uat/**"],
    "writeDeny": ["deploy/production/**", "infrastructure/**"]
  },
  "toolActions": {
    "allowed": ["deploy_to_uat", "deploy_to_dev", "check_deployment_status", "rollback_uat"],
    "denied": ["deploy_to_production", "modify_infrastructure", "access_secrets", "delete_environment"],
    "bash": {
      "allow": ["kubectl apply * --namespace=uat*", "docker build *", "docker push *", "git *"],
      "deny": ["kubectl * --namespace=production*", "kubectl delete namespace *",
               "rm -rf *", "sudo *", "terraform destroy *", "aws iam *"]
    }
  },
  "riskBudget": {
    "maxPerSession": 50,
    "thresholds": { "warn": 25, "throttle": 35, "critical": 45, "exhausted": 50 }
  }
}

Supported Frameworks

The sidecar proxy (docker-soe) is the recommended integration method. It requires zero code changes to your agent.

Configuration Reference

Environment Variables

Authentication

Sentinel-Ops supports three authentication methods:

1. JWT tokens (SOE_JWT_SECRET): Best for production. Supports token rotation via SOE_JWT_SECRET_PREVIOUS.
2. API key (SOE_API_KEY): Simpler setup. Pass via Authorization: Bearer <key> or X-SOE-API-Key header.
3. Disabled (SOE_AUTH_DISABLED=true): Development only. Never use in production.

The /v1/health endpoint is always unauthenticated for load balancer health checks.

Troubleshooting

Agent gets "denied" unexpectedly

1. Check which pattern caused the deny. The reason field in the response tells you exactly which pattern matched.
2. Use /v1/simulate to test the specific tool call against your policy.
3. Check if the agent's risk budget is exhausted (GET /v1/agents/:id/risk).
4. Verify environmentScope matches SOE_ENVIRONMENT.

Policy changes not taking effect

Policies are hot-reloaded automatically when files change. If using the API:

1. Verify the deploy succeeded (POST /v1/deploy returns deployed: true).
2. Check health endpoint for definitionsCount and definitionsLastReloaded.

High latency on evaluate calls

Deterministic evaluation should be under 1ms. If you see higher latency:

1. Check if the AI judge is being invoked. The layer field will show sentinel-ai for AI-evaluated calls.
2. Check CloudWatch metrics for soe_evaluation_duration_seconds.

Risk budget resets

Risk budgets are per-session. A new session starts a fresh budget. If you need persistent risk tracking across sessions, the Arbiter module maintains cumulative risk state.

Resources

• Security White Paper — Security architecture, threat model, compliance posture, and operational security practices (PDF, v1.2)

Support

• Email: support@yadriworks.ai
• Documentation: yadriworks.ai/docs

Sentinel-Ops is built by YadriWorks Inc., a Delaware C-Corporation.