A security boundary for LLM-powered systems.
SentinelLLM inspects untrusted inputs, enforces deterministic policies at the tool boundary, gates sensitive actions behind human approval, and records security decisions for inspection.
How an untrusted input traverses the security boundary
Why prompt engineering is not an enforcement boundary.
Language models cannot reliably differentiate between developer instructions and untrusted data embedded in user inputs, retrieved RAG documents, or tool responses. When applications give models autonomous access to databases, email dispatches, or APIs, system prompts alone cannot guarantee safety.
SentinelLLM introduces hard software boundaries: inspecting text at ingress, evaluating deterministic policies before any tool is invoked, and holding high-consequence operations for human cryptographic sign-off.
Six layers of runtime governance.
Look for suspicious instructions in incoming content
Scans prompts and retrieved knowledge chunks for direct instruction overrides, persona hijacking, and delimiter collisions before requests touch model infrastructure.
Evaluate proposed actions against explicit rules
Deterministic policy decisions replace probabilistic self-policing. The engine decides whether an action is safe, requires supervisor approval, or must be blocked immediately.
Prevent actions that lack authorization
A zero-trust Policy Enforcement Point sits between the agent and backing APIs. Tools cannot be executed without parameter validation and verified caller roles.
Require a human decision for sensitive operations
High-impact tool invocations are suspended out-of-band. Execution resumes only after an authorized human reviews the request and signs an approval token.
Keep a structured record of security decisions
Every inspection verdict, policy decision, parameter hash, and tool execution is persisted in an append-only audit store with complete contextual telemetry.
Test the system against known adversarial examples
PromptProbe harness evaluates detection accuracy and enforcement invariants across 23 single test cases and 10 multi-turn scenarios without live model expenses.
Adversarial benchmark & transparent limits
Tested against 23 starter cases covering direct injection, jailbreaks, tool abuse, and data exfiltration. Demonstrates 100% precision, 87.5% recall, zero unauthorized tool executions, and full disclosure of a known false negative on Base64 evasion (INJ-DIR-002).