A3S Sentry
Tiered runtime security control for AI agents, built on observer events and kernel guard enforcement.
A3S Sentry
a3s-sentry is the policy brain for A3S Observer. Observer emits what an agent
actually did; Sentry judges those events through escalating tiers and writes
deny decisions for Observer's kernel guards to enforce.
observer NDJSON -> L1 rules -> L2 LLM -> L3 A3S Code agent
-> deny files -> observer guards -> kernel deniesCapability Map
| Area | Current capability |
|---|---|
| L1 rules | Deterministic regex rule engine, configurable with ACL policy, including built-in rules for dangerous commands, credential access, SSRF, prompt injection markers, and secret-like content. |
| L2 judge | Fast OpenAI-compatible LLM classifier for events L1 escalates. |
| L3 judge | Deep A3S Code agent investigation with security skills for events that need contextual reasoning. |
| SAE tier | Sparse-autoencoder signal path for model-output activations emitted by A3S Power. |
| Inline gate | inspect_wire can judge decoded LLM/MCP wire content and mask concrete secret/PII spans before forwarding. |
| Policy admission | Canonical native-ACL envelopes bind policy bytes to an exact workload, revision, replica, node, generation, and SHA-256 digest. |
| Enforcement | Writes egress, exec, or file deny records consumed by Observer guards. |
| Operation modes | Rules-only, dry-run, fail-closed, hot-reloaded policy, speculative parallel L2/L3 on high-risk events. |
| SDKs | Native Python and TypeScript SDKs expose in-process evaluation over the same Rust engine. |
Start Here
- Pipeline explains L1 rules, L2 LLM, L3 agent investigation, SAE signals, speculation, and fail posture.
- Inline Gate documents pre-forward wire inspection and secret/PII masking.
- Configuration lists daemon environment variables, SDK ACL config, site rules, fail posture, and deny sinks.
- Workload Policy Envelope defines canonical bytes, exact trusted-state verification, and the current enforcement boundary.
- Operations covers deployment, dry-run rollout, metrics, queues, and deny-file behavior.
- Deployment Runbook expands the Kubernetes DaemonSet, rollout, alerting, restart, and outage procedures.
- SAE And Evaluation documents the model-output activation tier, explainability payload, tests, soaks, and accuracy corpus.
- SDK explains in-process Python and TypeScript embedding.
Relationship To Observer
Observer supplies the signal and the kernel enforcement primitive. Sentry owns policy evaluation. This keeps observe and intervene separated: telemetry can continue even when an enforcement policy is disabled or being tuned.
Boundary
Sentry does not enforce by itself. It emits decisions and deny records; Observer guards perform the kernel-level block. A verified workload policy envelope is admission evidence only, not proof that a workload-scoped backend applied it.