A policy layer for teams shipping autonomous agents. Allow, deny, or hold every high-risk tool call for a human — with a full audit trail of what your agents did.
Sentinel sits between your agent and the things it can do. Three steps stand between an agent's intent and a real side effect.
Before running a high-risk tool, your agent calls the decision point — one HTTP request. Works with LangChain, CrewAI, MCP, or plain code.
Declarative per-tool rules — a glob plus a condition on the arguments — evaluate by priority. First match wins; unmatched calls fall through to your default.
Allow, deny, or hold for a human — every decision recorded in an immutable audit log with who, what, and why.
No policy blocked it. The agent proceeds and the action is logged.
A policy — or the kill switch — forbids it. The agent is told it may not proceed.
It crosses a line a human should see. The action waits in the approval queue.
The decision point rides on everything you already need to run agents in production.
Every run is a span tree — prompt, guardrails, model, cost — PII-redacted at rest.
PII redaction and prompt-injection blocking before the model, leak-blocking after.
Anthropic → OpenAI → Gemini. Kill the primary and the run still completes.
Spend per tenant and per agent, with a monthly cap: block, warn, or degrade.
Freeze an agent and every action it attempts is denied instantly. No redeploy.
Score faithfulness and guardrail-pass-rate; block prompt regressions before they ship.
Open source and self-hostable. One endpoint stands between your agent and a mistake it can't take back.
Start governing →POST /v1/agents/{id}/actions/check
{ "tool": "refund", "arguments": { "amount": 5000 } }
→ { "decision": "pending", "reason": "refunds over $100 need a human" }Sits in front of the stacks you already build on