SENTINEL

Local Agentic AI · Proof of Concept

An advisory AI assistant for ISSO security control auditing that runs entirely on one workstation. No cloud service, no subscription, no data leaving the machine.

It reads the environment through seven read-only tools — the NIST SP 800-53 control catalog, the audit log, the POA&M register, the component inventory, control implementation status, and a local evidence corpus — then proposes findings, control mappings, priorities, and drafts. It never changes anything. The ISSO decides.

Why it exists

To answer a concrete question: can a genuinely useful agentic assistant for audit work run on hardware an organization already owns, inside an isolated environment, for 8 to 14 people, at no recurring cost? See docs/PAPER.md for the proposal and a claim-by-claim mapping to what the product actually does.

Quick start

Requires Python 3.11+, Node 20+, and Ollama.

git clone https://github.com/kennyfrodriguez/sentinel.git
cd sentinel
ollama pull qwen3:4b

cp .env.example .env          # set ENTRY_CODE and APP_SECRET_KEY
./scripts/dev-api.sh          # API on :8000, seeds the demo data
./scripts/dev-web.sh          # UI on :3000

Open http://localhost:3000 and enter the PIN from .env (default 1234).

Full instructions, including running it for other testers on the network, are in docs/DEPLOY.md.

What you will see

The Chat tab opens with a briefing the assistant computed before you asked anything: overdue POA&M items, an authentication spike, assets outside the scan window. Ask a question and the trace shows every tool it chose to call, with arguments, row counts, and timings, above the answer.

The Demos tab has seven prepared scenarios:

1. Anomaly triage — find the credential brute force and map it to AC-7
2. Weekly log review — turn a week of records into a findings table
3. POA&M prioritization — rank overdue work by risk, not by date
4. SSP drafting — write the AC-2 statement from your actual evidence
5. Coverage gap analysis — where the AU family actually breaks down
6. Assessment readiness — what is missing before an assessor arrives
7. Scan coverage — which assets quietly dropped out of scope

docs/ISSO_DEMOS.md is the presenter script: what each scenario should find, what is planted in the data, and what to say while it runs.

The guardrails

Read-only by construction. Every registered tool only reads. There is no write, delete, shell, or network tool, and anything outside the allowlist in backend/app/services/tools/registry.py is rejected before it executes. Ask the assistant to disable an account and it will explain that it cannot — not because it was told to refuse, but because no such capability exists.

Citations are checked, not trusted. Every NIST control identifier in an answer is compared against what the tools actually returned. Anything the model cited without retrieving is flagged under the answer, with the catalog's real title. This is enforced in code because a small model will occasionally produce a confident, well-formatted, entirely invented control reference — the one failure mode that would make the tool dangerous for audit work.

Ungrounded answers announce themselves. If the agent answers a data question without calling a tool, it is asked once to reconsider; if it still answers from general knowledge, the reply says so up front.

Data

Everything in the demo is synthetic and seeded on first boot: 24 controls, 14 assets, 14 POA&M items, six evidence documents, and about 300 audit events generated relative to today. The audit log contains six deliberate findings so the scenarios have something real to discover.

Layout

Path	Role
backend/app/api/	REST and SSE routers
backend/app/services/agent.py	Tool loop, step cap, concurrency queue
backend/app/services/tools/	The seven read-only tools and the allowlist
backend/app/services/seed.py	Demo dataset generation
backend/data/seed/	Controls, POA&M, inventory, evidence source files
frontend/src/app/page.tsx	UI shell
frontend/src/components/	Trace, demos, briefing, evidence, advisory banner
scripts/smoke.py	End-to-end check that the agent still calls real tools
docs/CONTEXT.md	Product and code context — read before changing behaviour

Limits

A 4-billion-parameter model makes mistakes. The trace and the citation check exist so a reviewer can verify the work rather than trust it. This is a proof of concept: it is not accredited, its output is not evidence, and the seeded data is not a real system.

Expect 50–90 seconds per answer on a 12 GB GPU. qwen3 reasons at length before replying and that cost is intrinsic to the model; the tool trace appears within a few seconds so you can watch it work. Sharing the GPU with anything else (a game, another model) will make it dramatically slower.