The sidecar inside your agent that signs every action.

Capture every tool call and sub-agent spawn, before execution.

The SDK hooks the agent framework's tool-call dispatch. Every call is captured as an OpenTelemetry span with full parameter context, then routed to Time Machine and Overseer in parallel with execution. If a policy decision is required (rare; most policy runs at the Gateway), the call is held until the verdict returns.

• OpenTelemetry-native. Spans flow through your existing OTel collector. No parallel pipeline.
• Pre-execution capture. Tool call observed before the call leaves the process, not after, when blocking is no longer possible.
• Sub-agent lineage. When an orchestrator spawns a child, the child's spans link to the parent and to the original human session.

from bladerun import Sentinel

# one decorator on your agent factory
@Sentinel.govern(agent_id="payment-orch")
def build_agent():
  return AgentExecutor(
    agent=agent,
    tools=tools,
    verbose=True,
  )

# every tool call now flows through
# Sentinel before execution.

Sign every agent session with a verifiable cryptographic identity.

When an agent session starts, the SDK requests a signed session credential from the local identity provider, your existing AP2, Okta, Ping, or Entra installation; X.509 fallback if needed. Every outbound call carries the signed identity. The Gateway rejects unsigned traffic at L1. The audit trail is signed end-to-end.

• Verifier, not issuer. Sentinel verifies whatever identity your organization already uses. We do not introduce a parallel identity system.
• Per-session credentials. Short-lived signed tokens with the originating human principal embedded.
• Tool-permission certificate. The agent's allowed tool set is signed alongside the session credential, enforced at Gateway L2.

# 1. agent session starts
session = Sentinel.begin_session(
  principal="jane.doe@bank",
  agent_id="payment-orch",
  tools=["read_account", "summarize"],
)

# 2. signed credential issued
session.credential
# > ed25519:sess_8a91d2c1f4...

# 3. every outbound call carries it
# Gateway L1 verifies. Unsigned = reject.

Subscribe to the Kill Switch. Enforce isolation at the call boundary.

Every Sentinel SDK in the agent fleet maintains a Redis pub/sub subscription. When Overseer fires the Kill Switch on a session, the targeted SDK denies any further tool call within milliseconds, at the SDK boundary, before the call leaves the process. Median time from anomaly detection to total isolation: under 50ms.

• In-process enforcement. Isolation does not depend on the Gateway being reachable. The decision happens inside your agent.
• Redis pub/sub fan-out. Single isolation event reaches every Sentinel in the fleet within ms.
• Manual + automatic. SOC dashboard can fire isolation manually; Overseer fires it automatically. Same mechanism.

# overseer detects anomaly · score 0.91
# > KillSwitch.fire(session_id="sess_8a91")

# every Sentinel SDK sees it within ms
# via redis pub/sub fan-out

# next tool call inside that session:
agent.invoke("transfer 50k to...")
# > SentinelIsolatedError(
# >   session_id="sess_8a91",
# >   isolated_at="2026-04-18T14:22:13Z",
# >   reason="overseer.anomaly_score_threshold")