The orchestrator process imports the Sentinel SDK. The SDK wraps the spawn primitive, whether that's a process exec, a thread, an HTTP call to a sub-agent service, or a framework-native spawn. Every spawn is signed; every sub-agent's calls are verified at the Gateway. Fleet behavior is published to a Kafka topic for the Fleet Correlator.
The orchestrator process. The SDK signs every spawn with the parent's identity and emits a lineage record.
Sub-agent inherits a signed credential and a tool-permission certificate scoped down to its declared task.
Every sub-agent's model and tool calls verified at the Gateway against the inherited credential and scoped cert. Behavior emitted to Kafka.
Lineage is not a runtime convention. It is a chain of signed credentials, persisted to Time Machine, and verified on every call.
The Sentinel SDK wraps the spawn primitive. At spawn time, the parent issues an Ed25519 signature over (parent_id, child_id, child_task, expires_at). The child receives the signed credential and inherits the parent's session_id and human_principal. Every subsequent call from the child carries the credential; the Gateway verifies the signature at L1 and rejects unsigned spawns.
The parent's tool certificate is a signed allowlist (e.g., read_account, initiate_wire, summarize). At spawn, the SDK computes the intersection with the child's declared task scope, a summarization sub-agent gets summarize only. The child cannot widen its certificate. The Gateway enforces at L2; out-of-scope calls are rejected without classifier evaluation.
Single-agent enforcement catches the obvious. Fleet-level enforcement catches the patterns that only emerge across cooperating agents, the supply-chain compromise, the synchronized scope deviation, the cross-type tool-use spike. Kafka and Redis carry the load.
Every agent's calls are emitted to a Kafka topic in your environment. The Fleet Correlator consumes the topic and evaluates rules across agents and agent types, novel parameter patterns, synchronized scope deviations, tool-use clusters not matched by any deployment event. Out-of-band; never blocks the call path.
When a fleet rule fires, the Kill Switch publishes a single isolation event on Redis pub/sub. Every Sentinel SDK subscribes; every targeted agent enforces locally in the same window. Median fan-out across hundreds of agents: under 50ms from publish to total isolation.
Isolation can target a single sub-agent, the parent's full subtree, or every agent of a matching type. Lineage records in Time Machine make the scope reviewable post-hoc; the SOC sees what was isolated, why, and what remained running.
The business-outcome twin of this page: the risk shape, the regulatory mapping, the supply-chain incident.
Read the use-case →The detection plane that fires the fleet-level Kill Switch. Per-agent baselines plus Kafka-driven cross-type rules.
Explore Overseer →Sub-50ms Redis fan-out. Lineage-aware forensic record in your S3, your KMS keys.
Explore Kill Switch →Drop the SDK into one orchestrator process. Point its model and tool calls at the Gateway. The Fleet Correlator runs in shadow mode for the first week. We show you the lineage tree, the fleet rule hits, and the per-agent scope rejects on real production traffic.