Sentinel sits between your agent and the things it can do. Four steps stand between an agent's intent and a real side effect.
Before running a high-risk tool, the agent calls the decision point. One HTTP request — no SDK, no framework lock-in. It works the same whether you built on LangChain, CrewAI, MCP, or plain code.
POST /v1/agents/{id}/actions/check
{ "tool": "refund",
"arguments": { "amount": 5000, "customer": "acme" } }Rules are declarative: a tool glob plus an optional condition on the call's arguments. They evaluate by ascending priority and the first match wins. Unmatched calls fall through to your default.
{ "tool": "delete_*", "effect": "deny", "priority": 10 }
{ "tool": "refund", "priority": 20,
"condition": { "field": "amount", "op": "gt", "value": 100 },
"effect": "require_approval" }A held action pauses in the approval queue with the tool and its arguments in full. The agent polls until a person decides. Approve and it proceeds; deny and it never runs — either way the decision is recorded with who and why.
GET /v1/actions/{id}
→ { "decision": "pending" } … a human approves …
→ { "decision": "approved" }When something looks wrong you do not want to hunt for a deploy. Freeze an agent and every action it attempts is denied at once — no redeploy, no config push. Unfreeze to resume.
POST /v1/agents/{id}/freeze
→ every subsequent action: DENY (agent is frozen)No policy blocked it. The agent proceeds and the action is logged.
A policy — or the kill switch — forbids it. The agent is told it may not proceed.
It crosses a line a human should see. The action waits in the approval queue.
Every run is a span tree — prompt, guardrails, model call, cost — PII-redacted at rest.
PII redaction and prompt-injection blocking before the model, leak-blocking after.
Anthropic → OpenAI → Gemini. Kill the primary and the run still completes.
Spend per tenant and per agent, with a monthly cap: block, warn, or degrade.