ed25519
parent → child credentials, signed on spawn
Kafka
Fleet Correlator topic · cross-type rules
Redis
Kill Switch pub/sub · fleet fan-out
<15ms
per-agent gateway enforcement budget, p95
Where the components live

Orchestrator → Sentinel → spawn → Sub-agents. All signed, all logged.

The orchestrator process imports the Sentinel SDK. The SDK wraps the spawn primitive, whether that's a process exec, a thread, an HTTP call to a sub-agent service, or a framework-native spawn. Every spawn is signed; every sub-agent's calls are verified at the Gateway. Fleet behavior is published to a Kafka topic for the Fleet Correlator.

Your environment

Orchestrator · Sentinel SDK

The orchestrator process. The SDK signs every spawn with the parent's identity and emits a lineage record.

Spawn boundary

Signed credential · scoped cert

Sub-agent inherits a signed credential and a tool-permission certificate scoped down to its declared task.

Sub-agents

N sub-agents · BladeRun Gateway

Every sub-agent's model and tool calls verified at the Gateway against the inherited credential and scoped cert. Behavior emitted to Kafka.

Sub-agent lineage

How parent credentials cascade, and how tool permissions narrow on every spawn.

Lineage is not a runtime convention. It is a chain of signed credentials, persisted to Time Machine, and verified on every call.

Spawn semantics

Every spawn produces a fresh credential signed by the parent.

The Sentinel SDK wraps the spawn primitive. At spawn time, the parent issues an Ed25519 signature over (parent_id, child_id, child_task, expires_at). The child receives the signed credential and inherits the parent's session_id and human_principal. Every subsequent call from the child carries the credential; the Gateway verifies the signature at L1 and rejects unsigned spawns.

  • Signed at spawn. Ed25519 over the spawn tuple. Verifiable independently.
  • Inherited principal. Human session_id propagates through the chain. Audit collapses to one root.
  • Bounded lifetime. Child credential expires no later than the parent's session.
Live · spawn record
parent.spawn(task="summarize", child_id="sum/v1.1")
parent_id = payment-orch/v3.2.1
human_id = sso_4a18 (jane.doe@bank)
cert.sig = ed25519:a7f3c1d2…
expires_at = parent.session.end
✓ child verifies parent.sig at first call
→ time-machine · lineage_8a91 · written
Live · scope intersection at spawn
parent.tools = [read_account, initiate_wire, summarize]
task.scope = [summarize]
child.tools = [summarize]
child.call(initiate_wire, …)
→ Gateway L2: not in cert · BLOCK
reason: out-of-scope tool
audit: time-machine · sess_8a91/sum-v1.1
Tool-cert scoping

The child's tool certificate is the intersection of parent and task.

The parent's tool certificate is a signed allowlist (e.g., read_account, initiate_wire, summarize). At spawn, the SDK computes the intersection with the child's declared task scope, a summarization sub-agent gets summarize only. The child cannot widen its certificate. The Gateway enforces at L2; out-of-scope calls are rejected without classifier evaluation.

  • Intersection rule. child.tools = parent.tools ∩ task.scope. Always narrows, never widens.
  • Deterministic enforcement. L2 rejects out-of-scope calls before any classifier or model decision.
  • Examiner-defensible. A static, signed certificate is reviewable; a runtime-only convention is not.
Fleet-level enforcement

Behavior across agents, not just within them.

Single-agent enforcement catches the obvious. Fleet-level enforcement catches the patterns that only emerge across cooperating agents, the supply-chain compromise, the synchronized scope deviation, the cross-type tool-use spike. Kafka and Redis carry the load.

Fleet Correlator

Kafka consumer · cross-type rules

Every agent's calls are emitted to a Kafka topic in your environment. The Fleet Correlator consumes the topic and evaluates rules across agents and agent types, novel parameter patterns, synchronized scope deviations, tool-use clusters not matched by any deployment event. Out-of-band; never blocks the call path.

Kill Switch fan-out

Redis pub/sub · sub-50ms

When a fleet rule fires, the Kill Switch publishes a single isolation event on Redis pub/sub. Every Sentinel SDK subscribes; every targeted agent enforces locally in the same window. Median fan-out across hundreds of agents: under 50ms from publish to total isolation.

Lineage-aware isolation

Subtree, type, or session

Isolation can target a single sub-agent, the parent's full subtree, or every agent of a matching type. Lineage records in Time Machine make the scope reviewable post-hoc; the SOC sees what was isolated, why, and what remained running.

Connected to the rest of the platform

Multi-agent deployment uses four platform components on the call path.

Common questions

What architecture teams ask first.

How do spawn semantics work for our orchestration framework?
The Sentinel SDK provides a wrapper for the spawn primitive in Python (process, thread, async task) and a sidecar pattern for HTTP-style sub-agent calls. For LangGraph, CrewAI, AutoGen, and Bedrock Agents we ship adapters that hook the framework's native spawn so the lineage chain is preserved without code changes in the orchestrator. Custom orchestrators wrap a one-line call at the spawn site.
What's the per-agent overhead in a fleet of hundreds?
Single-digit milliseconds per call at the SDK boundary; under 15ms p95 through the Gateway including all four enforcement layers. Spawn signing is sub-millisecond. The Fleet Correlator runs out-of-band on Kafka. Fleet evaluation never blocks a call. We have customers operating fleets in the low thousands of agents on commodity infrastructure.
How is the tool-permission certificate scoped at spawn time?
child.tools = parent.tools ∩ task.scope. The intersection is computed at spawn time and signed into the child's credential. Children cannot widen their own certificates. Re-spawn is supported: a child spawning its own grand-child applies the same intersection rule against its already-narrowed certificate.
What happens if Kafka or Redis is partitioned?
Kafka loss degrades fleet-level detection while per-agent enforcement continues. The Gateway still verifies identity, scope, classifier, and DLP on every call. Redis loss degrades the Kill Switch fan-out latency; isolation falls back to per-SDK enforcement on the next call. Both failure modes are bounded and logged. Most banks run Kafka and Redis in HA inside their existing data plane.
How does Time Machine represent a 1000-spawn session?
As a tree of signed records, indexed by both session_id and lineage path. Replay can scope to a single sub-agent, the parent's subtree, or the full session. Each record is independently signed with Ed25519; verification is per-record, so the cost of replaying a deep tree is linear in the leaves you actually load.
Do you have a reference for fleet sizes and rule patterns?
Yes. The documentation covers our reference rule set for the Fleet Correlator (cross-type novel parameter, synchronized scope deviation, tool-use cluster, deployment-event correlation), tuning guidance per fleet size, and the cookbook for adding bank-specific rules. New rules are versioned and rolled out with shadow-mode evaluation before enforcement.
Pilot the architecture

Wrap one orchestrator. See the lineage and the fleet.

Drop the SDK into one orchestrator process. Point its model and tool calls at the Gateway. The Fleet Correlator runs in shadow mode for the first week. We show you the lineage tree, the fleet rule hits, and the per-agent scope rejects on real production traffic.