Sentry Pipeline

Sentry is a tiered judge. Cheap deterministic logic runs first; expensive judgment only runs when cheaper tiers cannot settle the event.

Observer event
  -> L1 rules
  -> L2 LLM classifier when L1 escalates
  -> L3 A3S Code investigation when L2 escalates
  -> decision + optional enforcement action

Tiers

Every tier implements a judge interface, so embedders can replace a tier without changing the escalation grammar.

L1 Rules

The built-in rule set targets unambiguous cases: privilege escalation, reverse shells, pipe-to-shell patterns, disk overwrite, credential-file access, cloud-metadata SSRF, and secret or injection markers in observed I/O. Extra rules can be provided through an ACL policy file and are hot-reloaded.

L1 is a fast triage layer, not a sandbox. It is intentionally conservative: if a case is ambiguous, it escalates rather than guessing.

For ToolExec, Observer reports argv_truncated and argv_incomplete when it could not capture the complete command. A dangerous captured prefix can still block, but an otherwise ambiguous incomplete command remains an L1 escalation. The in-process L2/L3 judges are not asked to infer that a missing suffix was benign.

L2 And L3

L2 is a classifier over the event. It is useful for false-positive reduction and quick semantic judgment.

L3 is an actual A3S Code agent. It loads security skills, considers the actor, the observed event, the possible attack chain, and the blast radius, then returns a structured verdict. It is slower but deeper.

Products that separate fast judgment from deep investigation can call Pipeline::evaluate_through_l2. It returns the L1 decision, optional L2 decision, effective decision, stage status, and escalation cause without invoking L3, applying fail_closed, or starting speculative L3. An Escalated result is work to persist and dispatch to a durable external L3 worker, not an allow.

Speculation

By default, L3 starts only after L2 escalates. With speculative parallelism, high-severity L1 escalations start L2 and L3 concurrently. A fast L2 block can short-circuit the result; otherwise L3's already-running deeper verdict becomes available sooner.

Fail Posture

Sentry defaults to fail-open: unresolved escalation allows the event. Set fail-closed only when the deployment has enough L2/L3 capacity or an allow-list posture that can tolerate blocking unknowns.

Rules-only fail-open mode catches direct block rules but does not enforce rules that only escalate. Incomplete ToolExec evidence is the exception: it remains an unresolved L1 escalation regardless of fail mode. The bundled daemon audits that result but does not provide a durable external L3 queue.