Known limitations

Sentinel refuses to call something an AI agent without evidence. It would be incoherent to hold our own product to a lower standard than we hold your traffic to. This page is what is not built, not finished, or not yet proven — maintained as carefully as the rest of the product.

Where Sentinel is today

Design-partner ready. Not enterprise-ready. It is being run with a small number of first customers, by hand, with the founder in the loop. If you need a self-serve, multi-region, SOC 2–certified platform today, Sentinel is not that yet, and we would rather tell you now.

Not built

• SSO/SAML and SCIM — on the roadmap. Listed as roadmap on pricing, never sold as a feature. Authentication today is email + a scrypt-hashed password with signed, HttpOnly session cookies.
• End-user MFA — planned.
• Self-serve data deletion — deleting an entire organization is a manual operation we perform on request and confirm. Individual scans and records can be deleted in-product.

Not finished

• Identity-provider connectors (Google Workspace, Microsoft Entra ID) are code-complete but beta: they are dormant until each vendor's OAuth security review clears. Google's restricted-scope review requires an independent CASA assessment and takes months. The connector chips on our home page say beta for this reason.
• Okta, Snowflake, Slack connectors — marked soon. Not written.
• The live path today is log ingest: you point Sentinel at egress or LLM-gateway logs you already have. That is the connector marked live, and it is the one the product is built around.

Infrastructure

• Single region, single node. One server, no high availability.
• SQLite storage. Excellent for pilot volumes; a Postgres migration path exists but has not been walked. Backups are operational, and a restore is tested rather than assumed.
• Ingest limits: 8 MB per request, 30 requests per minute — roughly 40,000 rows per call. Sized for a pilot, not for a full enterprise day. Tell us your volume and we will raise it.
• Demo organizations share the production database, flagged and expired automatically. Separate environments are planned.
• Not SOC 2 certified. Sentinel produces SOC 2 / ISO 42001 / EU AI Act evidence packs about your AI. That is not a claim about our own certification, which we do not hold.

The Preview report uses sample data

The example report on our home page describes Northwind Traders, a fictional company. It performs no analysis of your domain, your network, or anything else. It exists so you can see how findings, evidence and confidence work before trusting us with a log. Real findings only ever come from your own data, in a pilot.

What we are still testing — and want you to falsify

The detector has been proven against traffic we constructed. It has not yet been proven against a real autonomous agent in a real company, because we have not seen one. That is the purpose of the first pilots, and these are the assumptions most likely to break:

• A tool write within five minutes of an inference call implies the model drove it. If your gateway batches events, or an agent queues its work, we will under-report a real agent as an "AI-enabled service" rather than an agent.
• Agents reach tools at recognisable hostnames. If all egress leaves through a single internal proxy, every destination looks the same to us and correlation disappears.
• Logs carry an identity. Without one we cluster by source IP, which merges distinct actors behind NAT and can split one actor across hosts.

When Sentinel is wrong, we would rather you tell us than that we never find out. A confident wrong answer is a worse outcome than an honest Unknown.

What does not change

• We never collect prompts, completions, or request bodies. Metadata only.
• Nothing is called AI without an inference signal; nothing is called an autonomous agent without a tool write that follows one.
• Every risk and confidence score is a deterministic sum of named factors you can read. No model decides your risk.
• Audit history is append-only and tamper-evident.