Configuring the Sentinel behavioral monitor

Sentinel is Authensor's behavioral monitoring engine. While the policy engine enforces rules on individual actions, Sentinel looks at patterns over time. It detects when an agent's behavior changes from its established baseline, catching problems that single-action rules miss.

What Sentinel tracks

Sentinel monitors these metrics per agent session:

• Action rate: How many tool calls per time window
• Denial rate: What percentage of actions are blocked
• Tool distribution: Which tools the agent is calling and how often
• Argument patterns: Statistical properties of tool arguments
• Escalation rate: How often actions are escalated

Basic configuration

const guard = createGuard({
  policy,
  sentinel: {
    enabled: true,
    windowSize: 60_000,    // 1-minute sliding window
    baselinePeriod: 300,   // Build baseline from first 300 actions
  }
});

Anomaly detection methods

Sentinel uses two statistical methods:

EWMA (Exponentially Weighted Moving Average): Tracks a smoothed average of metrics. When the current value deviates significantly from the average, it triggers an alert. Good for detecting gradual drift.

CUSUM (Cumulative Sum): Accumulates small deviations from the expected value. When the cumulative deviation exceeds a threshold, it triggers an alert. Good for detecting sudden changes.

sentinel: {
  enabled: true,
  detectors: {
    ewma: { alpha: 0.3, threshold: 2.5 },  // 2.5 standard deviations
    cusum: { slack: 0.5, threshold: 5.0 },
  }
}

Alert handling

Register an alert handler to respond to anomalies:

sentinel: {
  enabled: true,
  onAlert: (alert) => {
    console.log(alert.metric);      // 'denial_rate'
    console.log(alert.expected);    // 0.05 (5% baseline)
    console.log(alert.observed);    // 0.45 (45% current)
    console.log(alert.method);      // 'cusum'

    // Send to your alerting system
    pagerduty.trigger({
      summary: `Agent anomaly: ${alert.metric}`,
      severity: alert.severity,
    });
  }
}

What anomalies look like in practice

Spike in denials: An agent suddenly starts hitting blocked rules it never triggered before. This could indicate a prompt injection that changed the agent's behavior.

Tool distribution shift: An agent that normally uses search and calculator tools starts calling email and file-write tools. This suggests the agent's goal has been hijacked.

Rate spike: An agent's action rate doubles. It may be stuck in a loop or executing an exfiltration attack that sends data in many small requests.

Sentinel without the control plane

Sentinel runs in-process with zero dependencies. It does not need a database or network connection. State is held in memory for the duration of the session. For persistence across sessions, connect to the control plane.

Combining with policy enforcement

Sentinel alerts can trigger automatic policy tightening. When an anomaly is detected, switch to a stricter policy:

sentinel: {
  onAlert: (alert) => {
    if (alert.severity === 'critical') {
      guard.loadPolicy('./policies/lockdown.yaml');
    }
  }
}

This creates an adaptive safety system that responds to threats in real time.