Sentinel — Secure Local-First AI Coding Agent

The Challenge: The standard AI coding assistant is a process on your machine with your permissions. That means it can reach your SSH keys, cloud credentials and wallets; it sends your source to a third party; and a single approval can authorise an arbitrary command. For a solo developer that is a calculated risk. For a business with client code or regulated data on the same disk, it is usually a policy violation nobody has written down yet.

The Result: An agent built on the opposite default. Nothing is permitted until it is named, the model runs locally so code never leaves the machine, and every action is recorded in a trail designed to detect its own modification.

The security model

• Hard sandbox. ~/.ssh, ~/.aws and crypto wallet paths are unreachable by construction, not by a rule the agent is asked to respect.
• Network off by default. The agent has no outbound access unless it is granted deliberately.
• Local inference. Runs against a local model through Ollama, so source code and secrets never reach a third-party API.
• Secret redaction. Credentials are stripped before content reaches the model, so a leak cannot happen at the prompt boundary.
• Prompt-injection defence. File contents are treated as data, never as instructions. This is the failure mode most agent products still have not addressed: a malicious string in a README should not be able to redirect an agent that reads it.
• Tamper-evident audit trail. Every action is logged such that modification is detectable. No telemetry, no phone-home.

The repository carries a written SECURITY_MODEL.md and a TRADEOFFS.md, because a security posture with no stated limits is marketing. Local models are weaker than frontier ones; a hard sandbox refuses work a permissive agent would complete. Those costs are documented rather than hidden.

Why it matters commercially

"Can we let this thing near our codebase?" is the question that stalls most business AI adoption, and it is rarely answered with anything more concrete than a vendor's assurance. Sentinel is the answer I built for myself before advising anyone else — and the same threat modelling is what I apply to a client's agent: what can it reach, what can it spend, what can it be talked into, and what survives to prove it afterwards.