SentryFlow
A permission-aware execution layer designed for AI agent scenarios. It uses a deterministic policy engine to validate, approve, and audit action plans generated by models, enabling precise control over the execution permissions of AI agents.
Timeline (last 90 days)
SentryFlow is a permission-aware execution layer for Alexa+ scenarios where the model is responsible for proposing actions, but only a deterministic policy engine decides what is actually executed.
In the SentryFlow architecture, a lightweight model running on a local laptop converts the user's natural language requests into an action plan, which is treated as untrusted input.
Each proposed action must pass through multiple checkpoints including schema validation, policy engine adjudication, suspension of sensitive operations pending owner approval, and pre-execution review, with full auditing throughout.
In the demonstration, a locally running Qwen model drafts the action plan.
User-defined rules are injected into the system as constraints and can only make the policy stricter, not relax permissions.
Owner approval is bound to the hash value of the action parameters, and the approval becomes invalid once the parameters change.
SentryFlow's approval carries three constraints—single-use, five-minute expiration, and transmission via an independent owner session—ensuring the agent can never approve itself.
In SentryFlow, denial takes priority over approval, and approval cannot override denial.
Each step is recorded in a hash-chained audit log, and each request generates a receipt documenting the request content, policy ruling, approver, and what was actually executed.
When a request claims all operations have been pre-approved (prompt injection), SentryFlow still refuses to stand down, demands unlocking approval, and blocks the vacuum cleaner operation for exceeding the consumption limit.
2 more timeline events
All Facts (12)
The entire SentryFlow system runs completely locally, does not depend on any paid services, and is backed by 110 automation tools.
50%UnverifiedIn the SentryFlow architecture, a lightweight model running on a local laptop converts the user's natural language requests into an action plan, which is treated as untrusted input.
50%UnverifiedEach proposed action must pass through multiple checkpoints including schema validation, policy engine adjudication, suspension of sensitive operations pending owner approval, and pre-execution review, with full auditing throughout.
50%UnverifiedSentryFlow is a permission-aware execution layer for Alexa+ scenarios where the model is responsible for proposing actions, but only a deterministic policy engine decides what is actually executed.
50%UnverifiedUser-defined rules are injected into the system as constraints and can only make the policy stricter, not relax permissions.
50%UnverifiedOwner approval is bound to the hash value of the action parameters, and the approval becomes invalid once the parameters change.
50%UnverifiedSentryFlow's approval carries three constraints—single-use, five-minute expiration, and transmission via an independent owner session—ensuring the agent can never approve itself.
50%UnverifiedIn SentryFlow, denial takes priority over approval, and approval cannot override denial.
50%UnverifiedEach step is recorded in a hash-chained audit log, and each request generates a receipt documenting the request content, policy ruling, approver, and what was actually executed.
50%UnverifiedWhen a request claims all operations have been pre-approved (prompt injection), SentryFlow still refuses to stand down, demands unlocking approval, and blocks the vacuum cleaner operation for exceeding the consumption limit.
50%UnverifiedThe SentryFlow demo client has two sessions, runs on protocol version 2025-11-25, and exposes 17 tools via tools/list.
50%UnverifiedIn the demonstration, a locally running Qwen model drafts the action plan.
50%