Sentinel — Secure Local-First AI Coding Agent

The Challenge: The standard AI coding assistant is a process on your machine with your permissions. That means it can reach your SSH keys, cloud credentials and wallets; it sends your source to a third party; and a single approval can authorise an arbitrary command. For a solo developer that is a calculated risk. For a business with client code or regulated data on the same disk, it is usually a policy violation nobody has written down yet.

The Result: A local-first agent implementation that makes path checks, action approval, and audit records explicit. The default inference path uses a local model. This is an independent engineering project, not a security-certified product.

Verified September 6, 2026: all 179 tests passed locally, including 12 new regression cases for command approvals, malformed input, and CLI decisions. Editable package installation and the installed CLI's version command also passed. These checks establish specific behavior, not complete isolation or resistance to every attack.

A real finding, repaired

The original 167 tests passed—but the controller's default command-approval setting was not consistently enforced. The CLI also silently approved recognized command names. Recognizing find or sort is not enough to establish that their arguments are harmless.

The repair enforces default approval in the CLI, controller, and executor. Rejected commands remain blocked even when approved; malformed quoting produces a controlled rejection; dry-run previews do not launch a process. Regression tests mock execution for potentially harmful inputs and assert that no subprocess starts without the required approval.

Business relevance: a green test suite is not the same as a tested permission boundary. The useful deliverable is a reproducible failure, a bounded fix, and a test that prevents recurrence. The same method can be applied to an existing agent workflow before extending its access or adding more automation.

The security model

• Filesystem checks. The file-access layer resolves paths and rejects protected paths, traversal outside the project, and excluded file patterns.
• Command and network policy. Application checks classify commands and require approvals. A subprocess working directory is not an OS sandbox; it does not by itself constrain every approved program's filesystem or network access.
• Local inference by default. The local-model path avoids sending source to a hosted inference API. Any optional remote integration needs its own configuration and data-handling review.
• Secret-pattern redaction. Recognized credential patterns are redacted. Unknown formats and contextual sensitive data can be missed; this is a layer of defense, not a leak-proof guarantee.
• Prompt-injection risk reduction. Source content is framed as data and suspicious patterns are checked. Delimiters and detection rules do not establish complete resistance to prompt injection.
• Hash-linked audit records. Entries include the previous entry's hash to support integrity checking. A hash chain alone cannot prevent a privileged attacker from rewriting the entire log; stronger assurance needs an independently protected anchor or log destination.

The repository carries a written SECURITY_MODEL.md and TRADEOFFS.md. Some design-language claims in those documents are stronger than the inspected implementation supports. This case study describes the implementation conservatively rather than repeating those guarantees. Before production use, the next work is adversarial testing, OS-level containment appropriate to the host, and protected audit storage.

Why it matters commercially

"Can we let this thing near our codebase?" is the question that stalls most business AI adoption, and it is rarely answered with anything more concrete than a vendor's assurance. Sentinel is the answer I built for myself before advising anyone else — and the same threat modelling is what I apply to a client's agent: what can it reach, what can it spend, what can it be talked into, and what survives to prove it afterwards.

Explore a guardrails review, compare the project evidence, or scope your system's boundaries.