AgentSentinel: Secure AI Agent Oversight

• AgentSentinel is a security and observability framework for agentic AI systems, integrating dedicated monitoring layers to oversee agent behavior.
• It enforces policies through real-time detection and authorization mechanisms, ensuring safe operations in both multi-agent and computer-use environments.
• Implementations range from centralized coordinator models to distributed zero-trust architectures that leverage provenance tracking and runtime audits.

AgentSentinel denotes a family of security and observability mechanisms for agentic AI systems in which a dedicated sentinel layer monitors, constrains, verifies, or explains agent behavior at runtime. In current arXiv usage, the name refers both to a design construct for LLM-based multi-agent systems built around Sentinel Agents and a Coordinator Agent, and to an end-to-end, real-time defense for computer-use agents that intercepts sensitive operations at the operating-system boundary (Gosmar et al., 18 Sep 2025, Hu et al., 9 Sep 2025). Closely related formulations—including graph-based oversight agents, task-centric access control, distributed zero-trust sidecars, provenance-bounded guards, and authority-control layers—treat safety not as a property of an individual model prompt alone, but as a systems problem involving tool execution, shared state, inter-agent communication, provenance, and policy enforcement (He et al., 30 May 2025, Cai et al., 30 Oct 2025, Wu et al., 24 Apr 2026, Qin et al., 27 May 2026).

1. Definitions and conceptual scope

In the multi-agent systems literature, a Sentinel Agent is defined as a specialized AI entity whose function is to monitor and analyze the flow of messages within a multi-agent environment, with responsibilities spanning prompt injection detection, collusion detection, hallucination detection, privacy enforcement, policy enforcement, and auditability (Gosmar et al., 18 Sep 2025). In this formulation, AgentSentinel is an implementation-oriented name for a dedicated, AI-powered security and observability layer attached to a Shared Conversational Space through which agents coordinate.

A distinct usage appears in computer-use agents, where AgentSentinel is an end-to-end and real-time security defense framework that intercepts all sensitive operations within agent-related services and halts execution until a comprehensive security audit is completed (Hu et al., 9 Sep 2025). Here the central object is not inter-agent text exchange but executable side effects on a user’s machine: process creation and termination, file access, file deletion or renaming, and network connectivity.

Related systems widen the term’s practical scope. "SentinelAgent: Graph-based Anomaly Detection in Multi-Agent Systems" models a multi-agent execution as a directed interaction graph $G=(V,E)$ over agents, tools, and messages, then performs anomaly detection at node, edge, and path levels (He et al., 30 May 2025). "Who Grants the Agent Power? Defending Against Instruction Injection via Task-Centric Access Control" frames the problem as dynamic task-bounded authorization and formalizes policy rules as

$$(Agent, Resource, Operation, Context) \to \{\text{Allow}, \text{Deny}\}$$

with default-deny semantics (Cai et al., 30 Oct 2025). "SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems" introduces a Delegation Chain Calculus and a delegation token

$$\tau = (\mathit{id}, \mathit{src}, \mathit{dst}, \sigma, \iota, \pi, h_p, t_{\exp}, \mathit{sig})$$

to make authority, policy, and forensics explicit across multi-agent handoffs (Patil, 3 Apr 2026).

This suggests that “AgentSentinel” now names less a single implementation than an architectural pattern: a separable guard layer positioned around, above, or between agents, tools, and environments.

2. Architectural patterns

The canonical multi-agent architecture is dual-layered. Sentinel Agents continuously inspect traffic in a Shared Conversational Space, while a Coordinator Agent acts as the central governance and orchestration authority that disseminates policies, manages admission and quarantine, ingests alerts, and emits decisions back onto the shared space (Gosmar et al., 18 Sep 2025). The message substrate is represented as a schema-light JSON envelope with fields such as sender, type, content, metadata, and timestamp, and alerts extend that envelope with flagged, reasons, matches, summary, ai_raw, and the original message. The design target is system-level visibility: Sentinels see more than any individual worker agent can see locally.

A second architectural line treats the agent ecosystem as an execution graph rather than a message bus. In this view, nodes encode agents and tools, edges encode inter-agent messages, tool invocations, ledger accesses, and other interactions, and anomalies may appear as unexpected node behavior, suspicious edge content, or attack paths spanning multiple nodes and turns (He et al., 30 May 2025). The purpose is not only detection but root-cause attribution: which agent, which tool, and which path produced the unsafe system output.

A third line moves from centralized governance to distributed zero-trust enforcement. Distributed Sentinel introduces a Sentinel Sidecar for each agent or domain, a local knowledge graph $G_i$, and a Semantic Taint Token protocol carrying provenance and constraints across domains without exposing raw data (Wu et al., 24 Apr 2026). Cross-domain decisions are then made through Boolean predicate queries and counterfactual graph simulation rather than a monolithic global context. This architecture is motivated by Context-Fragmented Violations, where each local action is legitimate relative to its private context, but the composed action sequence violates a global invariant.

Computer-use variants position the sentinel at the operating-system boundary. AgentSentinel for computer-use agents uses agent instrumentation, a monitoring server, a system tracer and enforcer built with eBPF and Linux Security Modules, and a security auditor combining rules with LLM reasoning (Hu et al., 9 Sep 2025). The defended object is the full process tree induced by agent tool calls, not merely the text prompt that triggered them.

The deployment vocabulary across these papers is convergent. Sidecar, proxy or AI gateway, continuous listener, and hybrid modes recur as standard placements for sentinel logic; pre-validation, passive listening, and mixed blocking-plus-observability appear as common monitoring patterns (Gosmar et al., 18 Sep 2025). A plausible implication is that AgentSentinel design has become largely a question of placement: in-band or out-of-band, centralized or distributed, text-level or OS-level, policy-first or audit-first.

3. Detection, authorization, and verification mechanisms

The most common detection stack is layered. Sentinel Agents combine rule-based filters, behavioral heuristics, and semantic analysis via LLMs; prompt injection patterns such as override attempts can be recognized through regex, while repeated intrusive querying or paraphrased manipulations are pushed to model-based semantic classification (Gosmar et al., 18 Sep 2025). Retrieval-augmented verification extends this by checking factual claims against external APIs such as Wikipedia, Wikidata, Google Fact Check, or Bing Knowledge Graph and flagging discrepancies.

Graph-based variants add structural reasoning. SentinelAgent evaluates node status against role conformance and tool permissions, edge status against content safety and control-flow expectations, and then matches subgraphs against an attack-path library for multi-step exploits such as prompt injection followed by orchestrator misplanning and unsafe code execution (He et al., 30 May 2025). This makes collusion, ledger poisoning, and latent exploit chains first-class detection objects rather than anomalies inferred from isolated prompts.

Another mechanism class is authorization-centric rather than anomaly-centric. AgentSentry for GUI and Model Context Protocol agents derives a task-scoped PolicySet from user intent, activates it through a Policy Decision Point and Policy Enforcement Point, and enforces default-deny over all runtime actions (Cai et al., 30 Oct 2025). AIRGuard generalizes this into runtime authority control for tool-using agents by normalizing heterogeneous tool calls, deriving step-level authority from task authority, tracking source and target trust, simulating sensitive side effects, auditing cross-step risk, and deciding among allow, audit, ask, inspect, sandbox, quarantine, and block before actions execute (Qin et al., 27 May 2026). Its core claim is that untrusted resources may inform reasoning, but they must not authorize side effects.

A causally explicit variant models indirect prompt injection as temporal causal takeover. AgentSentry localizes takeover points at tool-return boundaries through controlled counterfactual re-executions, estimates user and mediator effects, and then performs context purification that removes attack-induced deviations while preserving task-relevant evidence (Zhang et al., 26 Feb 2026). This reframes defense from static filtering to causal diagnosis plus safe continuation.

Formal delegation frameworks push verification into authority chains. SentinelAgent for federal multi-agent systems enforces authority narrowing, policy preservation, forensic reconstructibility, cascade containment, scope-action conformance, and output schema conformance through a non-LLM Delegation Authority Service and the Intent-Preserving Delegation Protocol (Patil, 3 Apr 2026). Its treatment of intent preservation is deliberately probabilistic, while the remaining properties are deterministic and mechanically modeled.

4. Governance, observability, and trust boundaries

Observability is a defining feature of most AgentSentinel formulations. The multi-agent Sentinel Agents framework records an append-only NDJSON log, exposes POST /publish, POST /analyze, GET /alerts, and /ws/alerts, and retains reasons, per-rule matches, and Coordinator decisions to support traceability, root-cause analysis, and compliance (Gosmar et al., 18 Sep 2025). The Coordinator Agent can quarantine senders and publish a decision envelope back to the same Shared Conversational Space, producing an explicit audit trail of both detection and response.

Computer-use AgentSentinel extends observability from messages to system traces. It instruments fork, exec, kill, exit, open, remove, rename, connect, listen, accept, and DNS-related events; maintains “interesting processes” and “enforced processes”; and suspends a process when an enforced sensitive operation occurs so that an audit can run before the side effect is allowed or the process tree is terminated (Hu et al., 9 Sep 2025). The system models secure execution as a composition of secure action, secure context, and secure side-effect transformers, while explicitly allowing partial effects to remain if they happened before termination.

Distributed Sentinel makes trust boundaries explicit rather than centralized. Its Semantic Taint Token has the form

$$\text{STT} = \langle src\_id, taint\_vec, constraints, sig \rangle$$

and carries provenance, security labels, constraints, and a signature across domains (Wu et al., 24 Apr 2026). Counterfactual graph simulation then forks a local graph, applies a prospective mutation, checks local invariants, queries remote sidecars for cross-domain predicates, and commits only if all checks succeed. Because cross-domain responses are Boolean, the design aims to preserve data sovereignty while still supporting organization-wide policy enforcement.

These systems differ sharply on centralization. Coordinator-based designs favor centralized governance with distributed enforcement; Distributed Sentinel argues that monolithic interceptors are poorly matched to context fragmented violations; SentinelNet advocates decentralized per-agent detectors and bottom-$k$ elimination of low-credit neighbors during debate; and computer-use AgentSentinel uses a central monitoring server paired with OS-level enforcement (Gosmar et al., 18 Sep 2025, Wu et al., 24 Apr 2026, Feng et al., 17 Oct 2025, Hu et al., 9 Sep 2025). No single topology dominates across threat models.

5. Empirical evaluation and benchmarks

The empirical record is heterogeneous because the defended objects differ. In the Sentinel Agents multi-agent conversational prototype, 162 synthetic attacks were injected: 110 prompt injection attempts, 49 data exfiltration probes, and 3 hallucination probes. The reported detection rate was 100% for all three attack families, but there were no benign samples, no false-positive measurement, no latency evaluation, and no ablation of rule-based versus behavioral versus LLM components (Gosmar et al., 18 Sep 2025).

In computer-use agents, BadComputerUse comprises 60 attack scenarios across six attack categories, and the benchmark reports an 87% average attack success rate on four state-of-the-art LLMs without defense. Under the same setup, AgentSentinel achieves an average defense success rate of 79.6%, with average false positive and false negative rates of 10.8% and 4.2%, respectively (Hu et al., 9 Sep 2025). The same paper reports per-model defense success rates of 93.3% for Claude 3.5 Sonnet, 96.7% for Claude 3.7 Sonnet, 61.7% for GPT-4-Turbo, and 66.7% for GPT-4o.

Distributed zero-trust enforcement is evaluated on PhantomEcosystem, a benchmark of 200 scenarios with 160 attack cases and 40 legitimate controls across nine attack categories. Distributed Sentinel reports Precision $=0.93$, Recall $=0.96$, F1 $=0.95$, Accuracy $=0.92$, and 106 ms end-to-end latency, compared with F1 $$(Agent, Resource, Operation, Context) \to \{\text{Allow}, \text{Deny}\}$$0 for prompt-based filtering and F1 $$(Agent, Resource, Operation, Context) \to \{\text{Allow}, \text{Deny}\}$$1 for rule-based DLP (Wu et al., 24 Apr 2026). The same study evaluates eight frontier LLMs without the sentinel layer and finds violation rates from 13.8% to 97.5%, with cross-domain flows systematically harder than same-domain flows.

Runtime authority control reports a different trade-off. AIRGuard reduces Sonnet 4.6 attack success on AgentTrap from 36.3% without defense to 5.5%, and on DTAP-150 preserves 76.0% benign utility with Haiku 4.5, compared with 52.0% for ARGUS and 42.0% for MELON (Qin et al., 27 May 2026). Provenance-bounded Agent-Sentry reports prevention of over 90% of attacks that attempt to trigger out-of-bounds executions while preserving up to 98% of system utility, and on AgentDojo reduces attack success to 3.70% with 76.30% utility on GPT-5-mini traces (Sequeira et al., 24 Mar 2026). Causal AgentSentry reports ASR $$(Agent, Resource, Operation, Context) \to \{\text{Allow}, \text{Deny}\}$$2 and average Utility Under Attack of 74.55%, improving Utility Under Attack by 20.8 to 33.6 percentage points over the strongest baselines without degrading benign performance (Zhang et al., 26 Feb 2026). OS-Sentinel, in realistic mobile workflows, reports 10%–30% improvements over existing approaches across multiple metrics (Sun et al., 28 Oct 2025).

A narrower but influential line treats sentinelization as prompt-injection detection itself. "Sentinel: SOTA model to protect against prompt injections" fine-tunes answerdotai/ModernBERT-large for binary classification and reports internal AvgAcc $$(Agent, Resource, Operation, Context) \to \{\text{Allow}, \text{Deny}\}$$3 and F1 $$(Agent, Resource, Operation, Context) \to \{\text{Allow}, \text{Deny}\}$$4, with average public-benchmark F1 $$(Agent, Resource, Operation, Context) \to \{\text{Allow}, \text{Deny}\}$$5 (Ivry et al., 5 Jun 2025). This is a different granularity from runtime authority control or OS-level interception, but it often serves as the fast front-end classifier inside broader sentinel stacks.

6. Limitations, controversies, and future directions

A recurring limitation is incompleteness of evaluation. The Sentinel Agents conversational prototype explicitly states that the concept is largely architectural, lacks a full production implementation, has no benign traffic in its main experiment, has only three hallucination probes, and provides no scalability or latency benchmark (Gosmar et al., 18 Sep 2025). Computer-use AgentSentinel still exhibits false positives, can miss operations performed beyond the maximum enforced process depth, and may fail open for some processes under auditing time budgets (Hu et al., 9 Sep 2025).

Another persistent issue is that intent verification is intrinsically hard. SentinelAgent’s Delegation Chain Calculus states that deterministic intent verification is practically infeasible without restricting the input language to a formal grammar, and its adversarial paraphrasing stress test reduces intent-verification true positive rate to 13% even while deterministic properties remain intact (Patil, 3 Apr 2026). This is consistent with causal AgentSentry’s emphasis on intervention at tool-return boundaries rather than reliance on a single semantic classifier (Zhang et al., 26 Feb 2026).

There is also a structural debate over where enforcement should live. One line argues that per-agent security is hard to maintain, inconsistent across vendors, and blind to cross-agent patterns, motivating MAS-wide sentinel layers (Gosmar et al., 18 Sep 2025). Another argues that centralized interceptors are poorly matched to violations that span contextual islands and therefore favors distributed sidecars with local graphs and Boolean cross-domain queries (Wu et al., 24 Apr 2026). SentinelNet further claims that centralized oversight introduces a single point of failure and advocates decentralized credit-based detectors trained on adversarial debate trajectories (Feng et al., 17 Oct 2025). The literature therefore does not converge on a single governance topology; it converges on the claim that unmediated agent autonomy is insufficient.

Future work in these papers is unusually consistent. It includes balanced datasets with benign traffic and false-alarm measurement, larger and more diverse hallucination corpora, stronger adversarial robustness evaluation, scalability and latency studies for large-scale multi-agent systems, better entity resolution and grounding, stronger policy languages, integration with SIEM and infrastructure security tooling, and governance frameworks for decentralized ecosystems (Gosmar et al., 18 Sep 2025, He et al., 30 May 2025, Wu et al., 24 Apr 2026). A plausible implication is that AgentSentinel is becoming a reference category for secure agent infrastructure in the same sense that guardrails became a reference category for earlier LLM deployments: not a single algorithm, but a layered control plane spanning detection, authorization, provenance, observability, and runtime enforcement.