Sentinel·008: An Agent That Can Investigate, But Cannot Act Without Permission
Licence to Investigate — Not to Act
When a payment-failure alert fires at 2 a.m., the last thing an on-call engineer wants is an AI that can only talk. They want one that can investigate — and then stop before it does anything irreversible.
That is exactly what Sentinel·008 was built to do.
The Real Problem
A chatbot answers questions. An agent acts on them.
The moment you let a model query a database, run a diagnostic script, or roll back a deploy, three hard problems appear that a normal chat window never had to solve.
First, the model cannot reach your real systems. It has no natural way to talk to Grafana, your payments database, your logs, or your deploy pipeline.
Second, the code it generates can be dangerous. If the model writes a diagnostic script and you run it on a real machine, a single wrong line can delete data, hit the wrong endpoint, or hang forever.
Third, the model can do something irreversible before you even notice. Rolling back production is a one-way door. An agent that just does it is dangerous. An agent that is forced to ask for permission first is useful.
The layer that sits between the model and everything it touches, and handles all three of these problems, is called an agent harness. TrueForge defines this pattern clearly. The central test of the hackathon is simple: is the harness actually doing the work, or is it just a thin wrapper around a model?
Sentinel·008 was designed so the harness is visibly doing the work.
What Sentinel Does
When alert PAY-4471 fires and the payment success rate drops from 99.7% to 95.2%, Sentinel starts investigating the same way a senior SRE would.
It begins by reading Grafana to quantify the error rate. Then it searches the checkout logs, lists recent deploys, and finds a suspicious change: deploy 4c21, which went out just one minute before the spike and reduced the Stripe connection pool from 20 to 2.
Next, the agent writes a diagnostic and runs it inside an isolated sandbox. The sandbox has a hard timeout, no filesystem access, and no network. The result confirms the root cause — errors jumped from 9 to 165, an eighteen-times increase.
At this point the agent has enough evidence. It wants to run a rollback.
But it cannot.
The status changes to Awaiting Approval. A clear “Licence Required” gate appears on the screen. The agent loop is paused on a real control point. Nothing irreversible can happen until a human explicitly authorizes or denies the action.
This is the difference between a confirmation dialog and a real gate. The agent is not politely asking. It is structurally blocked from proceeding.
The Three Pillars in Action
Sentinel implements the three core ideas of an agent harness.
It reaches real systems through a tool surface for Grafana, logs, the payments database, and deploys.
It runs generated code safely inside an isolated sandbox with a hard timeout and no external access.
It stays under human control by pausing the entire investigation when an irreversible action is requested and waiting for an explicit decision.
On top of this, a live Chain of Evidence builds as the investigation progresses. Every strong signal — the payment drop, the deploy timing, the connection pool change, the sandbox reproduction — is recorded and visible in real time. When the session ends, this becomes a permanent Incident Autopsy with an evidence hash that a team can review later.
Why This Matters
Most agent demos fall into one of two traps. They either stay in pure chat mode, which is safe but not useful, or they act without real control, which is dangerous.
Sentinel sits in the middle. It does real investigative work, runs real diagnostic code in a sandbox, and enforces a hard human gate before anything that cannot be undone.
The interface is designed so a stranger can understand the entire investigation at a glance: what the agent is doing, what it is waiting on, and what it has already concluded.
Honesty
The tool data used in the demo is realistic but canned. The sandbox is a Node virtual machine, not a hardened microVM. These limitations are documented rather than hidden.
The goal was never to claim production-grade isolation. The goal was to make the three pillars of an agent harness visible, real, and demo a
ble in three minutes.
Final Thought
The future of agents is not agents that can do everything. It is agents that can do useful work while remaining controllable.
Sentinel·008 is a small step in that direction — an on-call agent that is allowed to investigate deeply, but is never allowed to act without permission.
Live demo: https://a1bbq7x7afg1-d.space-z.ai
Built for the TrueForge Agent Harness Hackathon.
_){kind=link}