Sentinel is the control plane for AI agents, bots and other non-human identities. It issues short-lived credentials, authorizes every tool call before it runs, brings a human in for the actions that matter, and keeps a tamper-evident record of all of it.
Self-hosted. Your keys stay in your Vault or cloud HSM. Works with the agent frameworks you already use.
agent refund-agent (owner: finance-ops) tool payments-mcp/refund args { amount: 6200, currency: "USD" }
Why agents need their own identity layer
Single sign-on, workload identity and secret managers assume a subject that is stable and predictable. An AI agent reasons, chooses its own next step, and can be talked into things. Governing it takes more than a key and a role.
The same agent can take a different path every run. Permission has to be checked at each call, against what it is about to do, not once at login.
A poisoned email, web page or ticket can turn a helpful agent against its owner. You need to see what it read before it acted.
Agents spawn sub-agents, share keys and outlive the project that created them. Someone has to own each one, and it has to retire cleanly.
The NHI Governance Framework
The framework breaks agent governance into seven layers that together answer who an agent is, what it may do, and who answers for it. Sentinel implements every layer. Read the framework.
Who is this agent?
Every agent is registered with a purpose, a risk tier, its allowed models and a named, accountable human owner.
What can it prove right now?
Signed tokens that live at most 15 minutes. Sub-agents get strictly narrower rights, and revoking a parent revokes its children.
May it make this call?
Each tool call is checked against allowlists, capabilities, argument limits, rate limits and budgets before it runs.
Is it still what we approved?
Model and workload attestation, behavioral baselines, and signals from content guardrails narrow or stop an agent that drifts.
Can we prove what happened?
A hash-chained, per-tenant record of every decision, with signed checkpoints and trusted timestamps.
Does it still need to exist?
Recertification, orphan and dormancy detection, reviewed capability changes, and clean retirement.
Who is accountable?
Rules decide when a human approves, edits or is notified. A kill switch pauses any agent in one step.
One decision record carries the result and reason of every layer, so an auditor, an engineer and an approver read the same story.
Sentinel
Agents call Sentinel before they act, directly through an SDK or through Sentinel's MCP proxy. Sentinel answers allow, deny or wait for a human, and writes the answer to the audit chain before the tool runs.
Authorization
Human oversight
Audit and evidence
Agent monitoring
A single allowed call can look harmless. Sentinel watches sequences across calls, sessions and the whole fleet, and raises one clear detection with the evidence attached.
Bursts with kill-chain progression, credential harvesting, enumeration, tampering with audit or logging, and unmanifested agents or compute, measured against each agent's own baseline.
Untrusted input, then a private-data read, then egress, in one session, is flagged even when every step was allowed on its own.
Plant decoy keys, secrets, tools, records and links. Anything that uses one is contained automatically and raises a critical alert.
An agent that keeps trying after being told no raises one aggregated alert, and a high-risk agent gets a pause proposal for an approver to confirm.
Checks that an agent behaves the same whether it thinks it is being tested or not, and holds up under pressure and injected instructions.
Try a new rule in log-only mode and read a "would have blocked" report before you enforce it.
Better together
Sentinel never reads content to make a decision, and Guardrails never decides authorization. Each asks the other through a published, versioned integration contract.
SentinelWho the agent is, what it may do, who must approve, and the audit record. Issues and revokes agent tokens; publishes keys at a standard JWKS endpoint.
Inspects prompts, tool inputs and tool results for injection, data leakage and policy breaches, and reports what it finds to Sentinel as signals that can narrow or stop an agent.
For developers
SDKs handle token refresh, delegation, approvals and trace propagation, and fail closed when Sentinel is unreachable. Or put Sentinel's MCP proxy in front of your MCP servers and change no agent code at all. Developer overview.
const sentinel = new SentinelClient({ baseUrl: 'https://sentinel.nhigovernance.org', agentId: 'agt_01HZX…', clientSecret: process.env.AGENT_SECRET, principal: 'user:1234' }); // Runs only after Sentinel allows it, or a human approves. const refund = sentinel.wrapTool('payments', 'refund', issueRefund, { waitForApproval: true }); await refund({ amount: 750, currency: 'USD' });
Deployment
Sentinel is self-hosted. Nothing about your agents, tools or audit trail leaves your environment. Security and trust.
Signing keys are created and kept in HashiCorp Vault, AWS KMS, Google Cloud KMS or Azure Key Vault, including HSM-backed keys. Private keys never sit on disk.
PostgreSQL row-level security separates tenants below the application, so one tenant's records stay out of another's reach even if a query is wrong.
Docker Compose for a single host, a Helm chart for Kubernetes. Several instances share one database and stay in sync, with single sign-on through OpenID Connect.
A pilot takes a few agents from registration to approvals, kill switch and audit evidence in your own environment. Tell us what your agents do and we will set it up with you.