AssureOps Sentinel

A Strands-powered CI evidence sentinel where agents propose, humans authorize, and exact-revision evidence decides readiness.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for AssureOps Sentinel

Inspiration

CI systems are good at reporting failures, and AI assistants are good at producing plausible explanations. Neither answers the operational question a release owner actually has: what trustworthy evidence is still missing before this exact revision can be released?

AssureOps Sentinel closes that gap without turning a model into an unreviewed release authority.

What it does

Sentinel receives a synthetic API change, identifies impacted assets, derives version-bound proof obligations, and asks a Strands Agent for a bounded proof plan. The proposal is checked against server-owned scope and shown to an independent reviewer.

Approval authorizes one exact action but deliberately leaves the release on Hold. Only after that action produces fresh, correctly bound evidence does deterministic policy derive Ready.

The NimbusCart demonstration shows a breaking delivery-quote API change affecting four downstream systems. It:

  1. detects two contract changes and four impacted assets;
  2. derives four exact-revision proof obligations;
  3. obtains a real Strands + DeepSeek proposal;
  4. records an independent review of one plan digest;
  5. proves that approval alone leaves four open gaps;
  6. executes one allow-listed synthetic test suite;
  7. verifies four JUnit evidence bindings; and
  8. appends twelve state transitions to a content-hashed audit chain.

How we built it

  • Strands Agents SDK provides the proposal-only agent runtime.
  • DeepSeek deepseek-chat is called through the Strands OpenAI-compatible adapter.
  • AWS Lambda hosts FastAPI and the React review workbench behind a Function URL.
  • AWS Secrets Manager supplies the model credential to a least-privilege role.
  • Amazon S3 stores content-addressed Lambda packages.
  • AWS CloudFormation declares the runtime and CloudWatch Logs captures operational proof.
  • Pydantic contracts, optimistic concurrency, idempotency, immutable artifacts, exact-revision JUnit binding, and a chained event journal enforce the trust boundary.

Amazon Bedrock and AgentCore adapters are implemented as optional extension paths. They are not represented as live runtimes: the verified competition path is Lambda + Strands + DeepSeek.

How Strands is used

Strands is not a decorative wrapper. It receives bounded change context and a strict structured-output contract, reasons about the required checks, and returns obligation references, test suggestions, one allowed action, and a human-escalation rationale.

The application validates that proposal against deterministic obligation IDs, the exact target revision, and the action allowlist. Timeouts, malformed output, provider errors, and scope drift all fail closed to a deterministic review-only plan.

The Agent never receives shell access, arbitrary HTTP tools, database-write tools, evidence-write tools, approval authority, or a release action.

Challenges

The hardest part was preserving a meaningful agent role without allowing model output to become evidence or truth. We also had to make review independent of request-body identity, bind authorization to a plan digest and revision, reject stale or wrong-scope evidence, and package the full Python plus React runtime within Lambda limits.

Our AWS account had zero AgentCore Runtime quota and Bedrock access required additional allowlisting. We kept those paths optional and deployed the primary Strands runtime to Lambda using the third-party model path permitted by the hackathon FAQ.

Accomplishments

  • Working AWS deployment with a private synthetic-demo access boundary.
  • Real Strands + DeepSeek proposal through the complete review and evidence workflow.
  • Approval demonstrably remains Hold until four exact-binding observations pass.
  • 146 automated tests and 60 adversarial evaluation runs with zero false-ready or unauthorized-side-effect outcomes.
  • Reproducible, hash-locked Lambda packaging and a public-boundary scan.
  • Complete UI for context, proposal, review, execution, evidence, policy, and immutable audit views.

What we learned

An agent creates more operational value when its authority is narrower and explicit. Separating proposal, authorization, evidence, and decision made failures easier to reason about and made the result more credible than a single “AI says safe” response.

What's next

The production path replaces Lambda temporary storage with PostgreSQL and object storage, maps review roles to workforce identity, adds durable execution, and ingests real CI events through product adapters. The same contract can serve multiple products while preserving per-module ontology profiles and version-bound evidence.

Agents propose. Humans authorize. Evidence decides.

Builder Center articles

Built With

Share this project:

Updates