System Architecture

Separation of decision and enforcement.

SentinelLLM adapts the proven RFC 2904 Policy Enforcement Point (PEP) and Policy Decision Point (PDP) model for modern LLM applications and autonomous agents.

Execution Topology


  [ CLIENT / USER / RAG SOURCE ]
                │
                ▼
  [ 01. INGRESS PEP ] ──────► [ 02. DUAL-TIER DETECTORS ] (Regex <5ms + RoBERTa)
                │                               │
                │◄──────────────────────────────┘
                ▼
  [ 03. POLICY DECISION POINT (PDP) ]
        ├── BLOCK   ──► [ Return 403 Denial & Quarantine Tokens ]
        └── ALLOW   ──► [ Dispatch to LLM Adapter / Model Inference ]
                              │
                              ▼
                        [ PROPOSED TOOL CALL ]
                              │
                              ▼
  [ 04. EGRESS PEP ] ───────► Check RBAC & Argument Schema
        ├── HIGH-RISK ──────► [ 05. HUMAN APPROVAL GATE ] (Signed Token Required)
        └── AUTHORIZED ─────► [ 06. TOOL DISPATCH ] (Isolated Execution)
                              │
                              ▼
  [ 07. AUDIT TELEMETRY ] ──► [ POSTGRESQL APPEND-ONLY STORE ]

Subsystems

Component Responsibilities

Ingress Policy Enforcement Point

PEP (Ingress)

Boundary: Untrusted Client / Network Boundary

Intercepts raw incoming prompt messages, multi-turn chat histories, and retrieved RAG context before any inference worker or model receives data. Routes payloads to the inspection engine.

Dual-Tier Detection Pipeline

Classifier Registry

Boundary: Inspection Boundary

First tier executes sub-5ms compiled regex heuristics for known imperative instruction overrides and delimiter clashing. Second tier executes transformer classification for semantic prompt injections and extraction attempts.

Deterministic Policy Decision Point

PDP

Boundary: Decision Boundary

Applies explicit, deterministic rules and risk scoring. Maps detection findings and caller roles to an immutable decision disposition: ALLOW, BLOCK, or REVIEW. Does not employ probabilistic LLM self-reflection.

Egress Tool Policy Enforcement Point

PEP (Egress)

Boundary: Tool / Execution Boundary

Intercepts model-generated tool calls before dispatch. Enforces parameter schema validation, checks role-based access permissions (RBAC), and verifies cryptographic tokens for sensitive operations.

Human-in-the-Loop Hold Gate

Cryptographic Authorization

Boundary: Two-Man Rule Boundary

Suspends execution of high-risk actions (e.g. bulk export, deletion). Issues a single-use approval request requiring an authorized supervisor to verify parameters and issue a signed execution token.

Append-Only Audit & Telemetry Store

Telemetry Store

Boundary: Persistence Boundary

Persists structured, sanitized records in PostgreSQL. Records request IDs, component decisions, latency timings, and SHA-256 parameter digests for compliance verification and incident triage.

← Return to Home Empirical Evaluations →