The control layer for
AI agents that move money.
Sentinel judges every agent action in real time. Routine actions pass straight through. Risky, irreversible, or policy-violating ones are frozen and escalated to a human — with full context and a tamper-evident audit trail, in seconds.
Built for fintechs & digital banks · MAS-grade maker-checker
Built with
The live console
Watch a poisoned wire get frozen.
Scripted agents fire real actions — money movement first, then infrastructure and access. Watch gpt-5.4 reason on each; the same identity → scope → policy → risk pipeline governs them all. Nothing here is hardcoded.
Capabilities are scoped grants, not broad roles. An action outside an agent's grant is a privilege escalation and is blocked on sight — before the risk model is even called.
Guardrail thresholds
Plain-language rules (read by the model)
Pay recurring monthly invoice to Acme Cloud (known vendor)
Issue $20 goodwill refund for a delayed order
Wire $25,000 to a newly-added supplier account
Pay $9,800 to Meridian Foods — marked urgent
Release $4,200 vendor payout flagged as a possible duplicate
Update bank-account details for supplier Meridian Foods
Issue $4,000 refund outside the standard refund policy
Pay $920 invoice to a vendor that usually bills around $300
Reverse a settled $1,150 card transaction
Update payroll bank details for employee J. Tan
Run scheduled month-end payroll for 84 employees
Export the full customer database to an external CSV
Send a promotional email blast to 12,000 customers
Deploy hotfix v2.3.1 to the checkout service
Delete the production `customers` database
Grant Org Admin to an external contractor
Run the console — every verdict and human decision is appended here as an immutable, hash-chained record.
How it works
A control layer, not a co-pilot.
Sentinel sits in the execution path. Three steps, one job: catch the risky action before it happens.
Agent acts
Your AI agent proposes a real-world action — a payment, a refund, a data export. It never executes directly.
Sentinel judges
Deterministic guardrails screen the clear cases instantly. The model adjudicates the grey zone. Low confidence always escalates.
Human owns the risky call
Routine actions pass through. Risky ones freeze and surface to a reviewer with full context — approved, edited, or blocked in seconds.
The hybrid engine
Deterministic guardrails for the clear cases — auditable and regulator-proof. The model only for the ambiguous middle. Every escalation is labelled with the layer that caught it.
Architecture
Under the hood: how one action is judged.
A single agent action flows through seven stages. Most are deterministic and never touch the model; the model is reserved for the grey zone — and a fail-safe bias governs every edge.
An agent proposes an action
Each action arrives tagged with the acting agent's identity — the start of a traceable delegation chain (user → agent → action).
Capability scope
Is the action inside the agent's least-privilege grant? Is the agent revoked? Enforced in the runtime before anything else runs.
↳Out of scope or revoked → blocked instantly. No model call.
Deterministic guardrails
Hard, auditable rules in code: maker-checker thresholds, new-payee limits, blast radius, customer-data protection. 100% explainable.
↳Any rule fires → escalate with the rule named. No model needed.
LLM adjudicator
The ambiguous middle only. gpt-5.4 (reasoning high) via the OpenAI Responses API with Structured Outputs → a strict, always-valid JSON verdict. A gpt-5.4-mini analyst streams its reasoning over SSE so you watch it think.
Decision combiner
Maps the model's score to policy-owned threshold bands and takes the most severe of (scope, guardrail, model). A fail-safe bias governs the edges.
↳Low confidence, timeout, or malformed output → review. Never auto-approves on doubt.
Human review
Escalations lift into a review panel with the risk gauge, factors, policy violations, delegation chain, and a suggested action — approve, edit, or block.
Audit trail
Every verdict and human decision is appended to a SHA-256 hash-chained, exportable log. Altering any row breaks every hash after it.
Architectural guarantees
The LLM never holds credentials
Identity, runtime, and tool layers are separate (the Auth0 model). The model judges — it never executes the action or holds a token.
Server-side only
The OpenAI key is read in a single route handler. It never reaches the client bundle — verified at build time.
Fail-safe by default
Any error, timeout, or low confidence defaults to review. The engine never crashes the demo and never auto-allows by mistake.
Deterministic + probabilistic
Auditable rules settle the clear cases; the model is reserved for genuine judgment. Each escalation is labelled with the layer that caught it.
Scripted stream, live verdict
The action stream is pre-authored for a reproducible demo; every risk verdict is judged at runtime. Nothing about the score is hardcoded.
Tamper-evident by design
The audit log is hash-chained, so the record can be handed to a regulator and independently verified.
the data contract
// Layer 2 is forced to return this exact shape
// (OpenAI Responses API · Structured Outputs · strict)
{
verdict: "allow" | "review" | "block",
riskScore: 0-100,
confidence: 0-1,
riskFactors: string[],
policyViolations: string[],
reasoning: string, // 1-2 plain-English sentences
suggestedHumanAction: string
}
// The runtime returns a combined JudgeResult:
{ ...verdict, guardrailHits[], caughtBy,
escalated, modelInvoked, failSafe, latencyMs }Integrate
Drop-in control for any agent.
Three lines.
Sentinel isn't a closed demo — it's a layer you wrap around your agent's tool calls. Wrap the tool, and every call it makes is judged before it can execute.
import { Sentinel } from "@sentinel/guard"; const sentinel = new Sentinel({ baseUrl: "https://sentinel-sable-nu.vercel.app", agent: paymentsAgent, // least-privilege grant }); // Wrap the tool your agent calls — now every call is governed. const safeWire = sentinel.protect(wireMoney, describeWire); await safeWire({ amount: 25_000, to: "Orion (NEW)" }); // ⛔ throws SentinelBlockedError before a cent moves
What you get
- Governs any tool call — money, infra, identity, data
- Returns a structured verdict (allow / review / block + reasoning)
- Fail-safe: on any error it escalates, never auto-executes
- Capability scope + human-in-the-loop, built in
- Zero dependencies · Node, edge & browser
// or judge without wrapping const v = await sentinel.guard(action); if (v.escalated) /* route to a human */
Positioning
Start where the stakes are highest: AI agents that move money.
Start narrow where the pain is sharpest, then expand to a horizontal control plane. Beachhead → Expand → Platform.
Beachhead
Fintechs & digital banks
agentic money movement
Irreversible, high-value actions
Wires, payouts, and payroll can't be undone. Escalation is obviously worth it.
MAS-grade audit & maker-checker
Regulators expect auditable controls and segregation of duties. This makes it buy, not build.
Risk & compliance buyers with budget
Teams that already think in escalation thresholds and false-positive rates — and own the budget.
Neutral cross-vendor control plane
Banks won't let each agent vendor grade its own homework. They want one independent layer.
Build vs buy
“A flag is a sprint. An audit-grade, cross-vendor control layer that a regulator will accept is not — and it isn't their core product.”
Use cases
The possibilities are endless.
Sentinel governs any AI agent that takes a consequential action — in any industry. Tap through a few of the countless ways it's used.
And many more…
Fintech & banking
The control layer for agents that move money.
User → Treasury Agent
Wire $25,000 to a 2-day-old account
User → Payments Agent
Pay $9,800 — just under the approval line
What Sentinel enforces here
One control plane. Any agent. Any action.