Continuum Sentinel

Inspiration

Enterprise agents are moving beyond chat into background workflows that deploy software, move money, delete records, and notify customers. The dangerous part is no longer one model response. It is the context that survives between sessions, crosses agent boundaries, and quietly gains authority.

Most observability tools explain an agent run after it happened. Most guardrails inspect one prompt or tool call at a time. Continuum Sentinel starts from a stricter principle: memory is evidence, not authority. Persistent context should be correlated, scored, and admitted like evidence before it can justify an irreversible action.

What it does

Continuum Sentinel is a governance plane for enterprise agent fleets. It accepts signed action receipts, correlates evidence across agents and sessions, and applies deterministic policy before remembered context can authorize a high-impact action.

The policy engine detects cross-tenant memory, prompt injection, tool poisoning, PII exfiltration, scope escalation, contradictory memory, stale high-risk evidence, insufficient verification, and replay. Safe evidence remains admissible. Contradictory evidence moves to human review. Compound attacks can trigger a quarantine recommendation.

A model-facing boundary is included through the official Google GenAI SDK. Only sanitized finding metadata is eligible to enter the narrative layer; raw memory values, tenant identifiers, event identifiers, agent identifiers, and tool payloads are withheld. The model can explain findings but cannot weaken deterministic policy or approve containment.

The public Judge Sandbox demonstrates the complete evidence-to-containment interaction using synthetic receipts and no credentials. It is intentionally labeled as a deterministic sandbox, not live-cloud proof.

Why it is agentic

Sentinel is designed to operate as a bounded background agent. It observes fleet receipts, retrieves prior evidence, correlates cross-session contradictions, chooses a policy outcome, opens incidents, prepares a sanitized operator narrative, updates fleet posture, and escalates only the irreversible decision to a human.

Its autonomy has explicit limits: it cannot grant itself authority, silently downgrade a deterministic finding, or quarantine an identity without an attributable approval receipt.

How it was built

-TypeScript, Node.js, Express, and Zod implement the service and strict receipt validation. -A deterministic policy engine owns admissibility and enforcement recommendations. -The official Google GenAI SDK provides a structured, privacy-reduced narrative boundary with a deterministic fallback. -Pub/Sub, Cloud Run, Firestore, and Secret Manager are represented in the deployment architecture and infrastructure automation. -Vitest validates safe admission, contradiction handling, cross-tenant quarantine, redaction, incident correlation, and approval identity boundaries. -A 100-case synthetic gauntlet covers six attack families.

Evidence and limitations

100/100 deterministic policy gauntlet cases pass.

11/11 behavioral and identity-boundary tests pass.

Production dependency audit reports zero known vulnerabilities.

Raw memory is excluded from the model input by construction and test.

The public demo is synthetic and credential-free.

The private Google Cloud deployment architecture was created, but an end-to-end externally authenticated Cloud Run proof was not completed before submission. No live-cloud claim is made.

What we learned

The hard part of enterprise agents is not generating another answer. It is designing authority boundaries around asynchronous systems that remember. Models can improve comprehension, but policy, identity, evidence, and human approval must remain separately auditable.

What's next

Next steps are OpenTelemetry GenAI adapters, a public cross-framework memory-poisoning benchmark, end-to-end latency measurement, security-reviewer agreement studies, and design partnerships with enterprise platform and AI-governance teams.

Built With

• cloud-run
• docker
• express.js
• firestore
• gemini
• google-genai-sdk
• node.js
• pub/sub
• secret-manager
• typescript
• vitest
• zod