<15ms
gateway enforcement budget, p95
OTel
native traces · spans on every turn
12
entity classes redacted per turn
in-proc
Sentinel SDK in the chatbot process
Where the components live

SDK in-process. Gateway in the call path. Model provider unchanged.

Two integration points. The Sentinel SDK is imported into the chatbot process and instruments at the model-call and tool-call boundaries. The Gateway sits between your chatbot tier and your model provider as a reverse proxy. Your application code does not change. Your model contract does not change.

Customer

Browser / mobile / IVR

Authenticated session. The customer types or speaks. The turn arrives at the chatbot tier in your VPC.

Your environment

Bank chatbot · Sentinel SDK

The chatbot process imports the Sentinel SDK. Identity, tool-cert, and span emission happen in-process; the SDK enforces the local Kill Switch.

BladeRun Gateway

Inspect · Verify · Redact · Log

Reverse proxy. Per-turn classifier, entity redaction, MCP-endpoint verification, response inspection, all under 15ms p95.

External

Any LLM Provider

OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex, or self-hosted. The provider sees only redacted prompts.

What runs in the call path

Four layers run on every turn, before the prompt leaves your perimeter.

L1 through L4 are the enforcement cascade applied to every conversational turn. Each layer is deterministic and independently auditable. A turn must pass all four to be forwarded; any single failure produces a structured policy decision with full provenance.

1

Identity verification

The chatbot agent presents a signed identity rooted in the authenticated customer session. Unsigned or expired turns are rejected before classification.

Deterministic
2

Tool-permission certificate

The chatbot's allowed tool set is checked. A deflection bot attempting cross-customer summarization is rejected at L2 regardless of prompt content or score.

Deterministic
3

Injection classifier · per turn

Direct injection on the user message and indirect injection on retrieved knowledge-base content, both flagged with origin context. Streaming responses inspected token-by-token with a buffered classifier.

Classifier
4

DLP redaction · 12 entity classes

Outbound: PAN, CVV, SSN, account number, customer ID, name-in-NPI-context, DOB, address, email, phone, government ID, free-text NPI. Deterministic per-session tokenization. Restoration on the response path before the customer sees it.

Deterministic
The reference deployment

SaaS, customer VPC, on-prem. Same enforcement. Same SLA.

Conversational deployments span everything from a managed cloud chatbot to an air-gapped sovereign workload. The enforcement plane is identical; the placement of the Gateway and Time Machine bucket changes.

SaaS

Managed cloud

Gateway runs in BladeRun's VPC, colocated with your model provider region. SDK in your chatbot tier. Time Machine writes to your S3 over PrivateLink. Single routing rule. Deploys in days. SOC 2 Type II in scope.

Customer VPC

Bank-managed VPC

Gateway runs inside your VPC under your IAM. No traffic leaves your perimeter to BladeRun. Meets OCC and Federal Reserve constraints on data flow. Federation participation is opt-in via one-way signal hashes.

On-prem

Disconnected deployment

For sovereign workloads. Sentinel SDK and Gateway run on-prem next to a self-hosted LLM (vLLM, TGI, Ollama). Time Machine on local MinIO. Equally functional; Federation is local-only.

Connected to the rest of the platform

Conversational deployment uses three platform components on the call path.

Use-case view

Conversational AI without exfiltrating the customer book

The business-outcome twin of this page: the risk shape, the regulatory mapping, the ROI conversation.

Read the use-case →
Sentinel SDK

The in-process instrumentation

Framework-agnostic. Imports into your chatbot process and instruments at the model-call and tool-call boundaries. OTel-native.

Explore the SDK →
Gateway

The reverse proxy in the call path

Per-turn classifier, MCP-endpoint verification, NPI redaction inline. Sub-15ms p95 across all four enforcement layers.

Explore the Gateway →
Common questions

What architecture teams ask first.

What's the actual latency budget on a conversational turn?
Under 15ms p95 end-to-end through the Gateway, including identity verification, tool-cert check, injection classification, and entity redaction. The SDK in-process overhead is sub-millisecond per turn for span emission and identity attestation. The dominant cost on a chatbot turn remains the model itself.
How does the Sentinel SDK integrate with our OTel setup?
The SDK emits OTel spans natively for every model call, tool call, and policy decision. If you already export traces to Datadog, Honeycomb, Jaeger, or an OTLP collector, the BladeRun spans appear alongside your existing instrumentation under the same trace ID. There is no separate observability stack to operate.
How are streaming responses handled?
SSE and chunked-encoding streams are inspected token-by-token with a buffered classifier. If a policy violation is detected mid-stream, the Gateway terminates the connection and surfaces a structured error to the application. Per-chunk overhead is sub-millisecond. The redaction restoration path also runs on the stream, so the customer sees their actual values restored as the response renders.
Which chatbot frameworks do you support?
Framework-agnostic. The SDK instruments at the model-call boundary, not the orchestration framework. We have customers running on plain Python services, FastAPI, Spring Boot wrappers, Bedrock Agents, LangChain, LangGraph, and proprietary internal chatbot tiers. Adding a new framework is a wrapper, not a redesign.
What happens if the Gateway becomes unreachable?
Two operating modes. Default is fail-closed: if the Gateway is unreachable, model calls are rejected and the chatbot returns a maintenance response. This is what banks typically choose for SR 26-2 defensibility. Fail-open is supported for non-regulated workloads. The Gateway runs as a stateless cluster behind a load balancer; rolling deployments and node failures are handled without traffic loss.
Can the SDK enforce locally if the Gateway is partitioned?
Yes. The SDK carries a cached tool-permission certificate and a recent denylist. During a partition, identity and tool-cert checks remain enforced locally; classifier and entity redaction (which require the Gateway) run in fail-closed mode. The behavior is the same as a network-isolated chatbot tier, known and bounded.
Pilot the architecture

Drop the SDK in. Point one chatbot at the Gateway.

The integration is two endpoints: import the Sentinel SDK in the chatbot process, point the model client at the Gateway. Inspection runs in shadow mode for the first week. We show you the per-turn latency, the classifier hit rate, and the redaction coverage on real production traffic.

Start a technical pilotRequest a technical session