The trust layer for AI agents.

Open-source runtime guardrails, a tamper-evident audit trail, and a kill switch — for any agent you build, in any framework.

Get started →  Read the docs
Apache-2.0framework-agnostic ~80 testsalpha
ENFORCE

Policy on every action

Default-deny YAML rules: allow, block, require human approval, thresholds, rate limits — checked before the tool runs.

RECORD

Tamper-evident audit

Every action in a SHA-256 hash chain. Any edit, reorder, or deletion is detectable with one command.

STOP

Instant kill switch

Pull the cord and the agent stops on its next call — even across processes. Plus human-in-the-loop approvals.

DETECT

Catch the bad stuff

Prompt-injection, PII in arguments, and the lethal trifecta (secret → untrusted input → egress) get flagged.

How it works

agent ─tool_call─▶ Sentinel ─▶ kill? ─▶ detect ─▶ policy (default-deny) │ tamper-evident audit ◀── run / block

Two lines to protect any agent

from sentinel import Sentinel
sentinel = Sentinel.from_files(policy="policies/starter.yaml", db="data/sentinel.db")

@sentinel.guard                 # every call is checked, logged, killable
def send_email(to, subject, body): ...

# …or guard a whole toolset at once:
tools = sentinel.wrap_all({"send_email": send_email, "search_web": search_web})

Works with plain Python, LangChain, OpenAI Agents, CrewAI, and MCP (proxy + server).

Compliance-aware

Export audit reports mapped to EU AI Act Art. 12, GDPR, NIST AI RMF, ISO/IEC 42001, the Colorado AI Act, and SEC/FINRA recordkeeping.

⚠️ Alpha software. The injection detector is heuristic v1 (not a silver bullet), and compliance mappings are indicative engineering aids — not legal advice or certification.