Rules an Agent Cannot Talk Its Way Around

Instructions in a prompt are suggestions. Allowlists, spend caps and an audit log enforced outside the model are rules. Why Sentinel's controls live in the loop, not in the system prompt, and what they cover.

A system prompt that says "never delete files outside the project" is a polite request. A tool layer that refuses the call is a rule. The difference is the whole safety story of an autonomous agent, and it is worth being precise about where each control lives.

Outside the model

Sentinel's policy layer sits between the model and the tools. Every tool call passes through it before anything runs, and the model cannot see or change it. It checks four things:

Allowed tools. Per session and per device: shell on the laptop on, shell on the mini on, browser on, payments off. A disabled tool is not in the model's tool list at all, so there is nothing to argue with.

Allowed paths. File and shell tools resolve every path and refuse anything outside the allowlist. The audit example on our product page shows the line this produces: deny laptop rm -rf / blocked by policy.

Spend cap. A daily budget in dollars across model calls. The ledger meters every request; when the cap is reached the agent finishes its current step with a cheaper model or stops with a note, and the owner raises the cap if they want to.

Devices. Which machines the agent may act on, and in which mode: full control, or view only for the phone.

An audit log that reads like a log

Every tool call, its device, its arguments in short, its outcome and its duration go to an append-only log, alongside every self-heal action. It is plain text in the product and the first thing we look at when something surprising happened. Agents that cannot explain what they did get switched off; the log is how ours earns the right to keep running.

Why not just prompt it

Prompts do shape behaviour, and Sentinel's system prompt does say what it should and should not do. But models are persuadable, by the owner having a bad day, by a web page the browser tool just read, or by their own reasoning taking a wrong turn. A rule that holds in all three cases has to be enforced by code that does not read the conversation. That is where ours is.

Private build, hosted build

In the private build the owner sets all of this and it is enforced on their own machine. In the hosted build, each account runs in its own container with the same policy layer, and the defaults are stricter: no shell on the host, paths limited to the workspace, payments off. The controls are the same code; only the defaults differ.

Resources