Sentinel — AI Security Officer for Ring

AI-powered security decisions. Human-controlled authority — an AI officer for Ring that understands the scene, enforces policy, and never opens the door on its own.

Comment

Inspiration

A Ring camera at a closed office at midnight can tell you there was motion. It can't tell you what to do about it or make sure a machine doesn't do something irreversible on its own. We wanted Ring to behave like a real security officer: understand the scene, weigh risk, follow policy, ask a human when it matters, act, and leave an audit trail.

What it does

Sentinel turns a Ring camera from a device that only watches into an AI security officer. It ingests Ring-format events through the Ring Developer Platform pipeline and Playground simulator, correlates a burst into one incident, uses Amazon Bedrock to produce a structured observation, computes deterministic risk, and runs every proposed action through a deterministic policy: ALLOW / REQUIRE_APPROVAL / DENY.

When the AI recommends granting temporary access to a stranger at a closed door after hours, the policy denies it — a rule the model cannot override. A safer action (warn the officer) requires human approval (web console or an Alexa+-compatible MCP client), then executes exactly once, on an append-only audit trail.

Core principle: intelligence may be probabilistic; authority must be deterministic; no LLM may authorize its own action.

How we built it

  • Sensing — Ring: HMAC-SHA256 X-Signature webhooks, documented {meta,data} payloads, and the Ring Playground simulator for events without a device. Verify → normalize → dedupe → correlate.
  • Intelligence — Amazon Bedrock: bedrock-runtime Converse (inference profile global.anthropic.claude-haiku-4-5) → strict-JSON SecurityObservation; authority-shaped output is rejected; failures degrade to a safe UNKNOWN.
  • Authority — SwarmOps (our governance layer): typed, versioned risk + policy engines; no LLM, no eval. Role-scoped, expiring approvals; idempotency- and concurrency-guarded exactly-once execution.
  • Human interface — Alexa+-compatible MCP: self-hosted MCP server (spec 2025-11-25, Streamable HTTP), 8 narrow typed tools, all calling the same authority.
  • Frontend/Backend: Next.js /sentinel command screen + FastAPI, in-process state (no database), ~134 tests.

Challenges we ran into

Keeping the AI out of the authorization path. The hardest design problem wasn’t using the LLM it was making sure it could never authorize an action. We solved it with a schema that rejects any authority-shaped field from the model and a pure, versioned policy engine that treats an AI recommendation as input, never as a decision.

Ring’s webhook signature scheme was hard to find. The docs are split across two surfaces and the base host is amazonvision.com; the HMAC-SHA256 X-Signature: sha256=… verification lived only in the full API doc. We implemented it from there and verified against the Playground simulator.

Amazon Bedrock model access is a multi-step gate. We hit an IAM permissions-policy vs. permissions-boundary confusion, a separate Anthropic use-case approval, and a newer model ID that wasn’t grantable on our account. We fixed it by attaching Bedrock access as a policy and switching to an invokable inference profile (global.anthropic.claude-haiku-4-5).

Guaranteeing exactly-once under retries and concurrent approvals solved with idempotency keys and a serializing execution engine that blocks duplicates.

Accomplishments that we're proud of

A security product whose hero moment is restraint an AI that says “open the door,” told no by a deterministic rule, with a human kept in command. That inversion (“AI recommended access. Security policy stopped it.”) is the whole pitch in one screen.

A real, end-to-end integration path: the official Ring developer pipeline (verified via the Playground simulator), a live Amazon Bedrock perception provider, and a working Alexa+-compatible MCP server (spec 2025-11-25, Streamable HTTP, 8 typed tools) all demoable without a physical device or keys.

Provable safety, not just claims: ~134 tests covering the invariants no-LLM-authorization, deterministic DENY, exactly-once, role/expiry/self-approval, adversarial prompts, and safe failure modes.

What we learned

People don’t want an autonomous door-opener they want an accountable one. Framing the AI as perception + recommendation and the policy as authority is what makes the product trustworthy and the demo land.

A deterministic authority layer above probabilistic, AI turned out to be a reusable pattern well beyond a doorway: any agent that can touch the physical or financial world needs provable limits, human approval for the risky path and an audit trail. Separating “intelligence” from “authority” is the design idea we will keep.

What's next for Sentinel — AI Security Officer for Ring

  • Bind to a live Ring account and add real snapshot-to-Bedrock vision (image understanding, not just event metadata).
  • Durable persistence for incidents and the audit trail (the officer layer is in-process today).
  • Production auth on the MCP endpoint mapped to real operator roles, plus data-retention controls.
  • Generalize the governance layer into a standalone open-source library so any AI agent — home, industrial, or financial — can get deterministic authority, human approval, and exactly-once execution for free.

Built With

Share this project:

Updates

Submission history