Sentinel Agent Middleware

A zero-trust agent middleware enforcing tenant isolation, prompt-injection defense, secret redaction, and human approval gates for safe execution.

Comment

Inspiration

Autonomous AI agents are shifting from passive chat interfaces to active execution environments—reading files, issuing shell commands, and invoking external APIs across multiple turns. However, granting LLMs access to execution runtimes without strict security boundaries introduces severe risks: accidental credential leakage, malicious prompt injection, privilege escalation across tenants, and uncontained destructive operations.

We were inspired to build Sentinel to solve the missing link in modern AI agent platforms: trusted, zero-trust middleware. Instead of trusting the model or relying on cosmetic frontend validation, Sentinel enforces deterministic security policies, tenant isolation, threat containment, and human approval boundaries directly at the server-side control plane.

What It Does

Sentinel sits between the user interface, the Fastify control plane, and the containerized Codex CLI execution runtime. It enforces end-to-end governance across every turn:

  • Multi-Tenant Identity & Isolation: Maps every request to an authenticated human principal (x-user-id) with cross-tenant blocking ($403\text{ Forbidden}$) preventing unauthorized access to other users' agents.
  • Granular Permission Scopes & Instant Revocation: Allows operators to scope agent capabilities (read, write, terminal). A dedicated kill-switch endpoint (/api/agents/:id/revoke) permanently locks an agent from future execution.
  • Threat Mitigation & Jailbreak Defense: Intercepts prompt injections (e.g., "Ignore previous instructions...") and rejects files tagged with confidential sensitivity metadata (MSIP classifications) before ingestion.
  • Data exfiltration via secrets in transit. Transmitting unredacted credentials (such as AWS keys, GitHub tokens, or passwords) within prompts exposes them to interception, resulting in credential theft, token compromise, and unauthorized API access. Conversely, failing to redact inbound secrets in model responses leaves sensitive data in storage or the UI—inadvertently turning the agent into a host for third-party credentials and risking significant financial or security losses for the affected organization.
  • Human-in-the-Loop Approval Boundary: Pauses dangerous or destructive operations (e.g., dropping production tables) into an interactive pending state, requiring explicit human approval (Accept/Deny) before touching the runtime.
  • Structured Audit Logging: Emits deterministic audit trails capturing security violation attempts, policy enforcement decisions, approval statuses, and token usage signals.

How We Built It

We designed Sentinel to hook cleanly into the Starter Kit's extension seams without breaking baseline workflows:

  1. Control Plane & Middleware Pipeline (Fastify + TypeScript):
    • Implemented modular request-intercepting middleware inside apps/server/src/middleware/identity/ and apps/server/src/middleware/safety/.
    • Built an interactive stateful gate inside AgentService to hold runs requiring human authorization.
  2. Frontend Controls (React + TypeScript):
    • Added user-switching controls, permission scope selectors (read, write, terminal), instant-revocation buttons, and dynamic approval confirmation modals in apps/web/src/.
  3. Runtime & Observability:
    • Decoupled AuditService to capture error categories, redaction events, and policy violations into a persistent JSON store.
    • Preserved disposable container execution across Docker, Colima, and Podman backed by the Volcengine/BytePlus Ark Responses API.
  4. Automated Verification:
    • Developed targeted automated test suites (test/agent-policy.test.ts, test/user-ownership.test.ts, etc.) to ensure policy boundaries cannot be bypassed.

Challenges We Faced

  • Preserving Asynchronous Turn Integrity: Inserting an interactive human approval gate into an asynchronous agent execution lifecycle required careful state management so runs could pause safely without timing out or corrupting the Codex workspace session.
  • Bidirectional Sanitization without State Distortion: Redacting API keys from model responses while preserving valid markdown formatting and syntax required fine-tuning our heuristic pattern matchers.
  • Boundary Ownership: Ensuring all security checks were strictly enforced on trusted backend execution seams rather than relying on frontend client-side state.

What We Learned

  • Defense in Depth is Essential for Agents: Guardrails cannot just be prompt templates; deterministic middleware at the control plane is necessary to prevent prompt injection and policy breaches.
  • Least-Privilege Architectures for LLMs: Scoping agent capabilities and maintaining distinct identities between human principals and agent workers drastically reduces the attack surface of automated tooling.

What's Next for Sentinel

  • Upgrading heuristic regex filters to dedicated, low-latency classifier models for complex semantic jailbreak detection.
  • Integrating OpenTelemetry and enterprise SIEM export pipelines for distributed audit tracking.
  • Adding fine-grained policy definition languages (e.g., Open Policy Agent / Rego) for dynamic enterprise access control.

Built With

Share this project:

Updates

Submission history