Safety Preview (Sentinel)

Sentinel is an experimental deterministic policy evaluator. Its decisions come from code and a validated policy document—not a model opinion.

Enable Sentinel

odinn experimental enable sentinel --confirm-impact

Restart a running gateway after changing the gate.

Current invariant types

The v0.4.0-beta.3 slice implements:

• command deny patterns;
• tools that require approval;
• filesystem allowed roots.

Unknown policy shapes fail validation instead of pretending to enforce them.

Validate before use

odinn experimental sentinel validate ./policy.yml

Test a proposed tool request:

odinn experimental sentinel test \
  ./policy.yml \
  --tool workspace.readText \
  --input-json '{"path":"README.md"}'

This advanced command uses structured input. The result explains whether the current invariants allow, warn, pause, block, roll back, or terminate.

Durable decisions

When Sentinel participates in runtime execution, its decision is recorded before the operation in the policy-evaluation store and hash-chained run ledger. A blocked operation cannot become allowed because the model describes it differently.

Design guidance

• Keep invariants narrow and testable.
• Validate policies before enabling them in an active workflow.
• Use allowed roots rather than broad path patterns.
• Treat a warning as information, not as a permission grant.
• Keep ordinary capability policy in place; Sentinel adds a deterministic layer rather than replacing it.

See the Policy schema for supported fields and enforcement actions.

Limits

Sentinel evaluates implemented invariant types. It does not understand every possible consequence of a command, contain hostile code, or guarantee remote rollback. Imported policy files are untrusted until reviewed.