Commitment Enforcement

Detection observes failure.
Enforcement prevents it.

SentinelX enforces the constraints your system was always supposed to obey—at the moment before an action becomes irreversible.

How It Works

Enforcement at the commitment boundary

The commitment boundary is the moment before an action becomes irreversible. Wire transfers commit when they leave the institution. Deployments commit when traffic shifts. Medication orders commit when administered.

SentinelX operates at this boundary. Before execution proceeds, the system asks one question:

Does a valid state transition exist for this action in this context?

The response is admissible or inadmissible. Synchronous. Deterministic. Logged.

            Application
            →
            POST /v1/enforce
            →
            Verdict
            →
            Execute or Impossible
          

SentinelX does not evaluate intent. It does not score risk.
It enforces invariant constraints. Inadmissible actions cannot exist.

Why Now

The gap between authorization and execution

AI agents cross execution boundaries

Autonomous systems initiate irreversible actions. No human in the loop.

Automation touches irreversible systems

Wire transfers, deployments, medication orders—one API call from commitment.

Detection happens after the fact

Observability tells you what happened. It cannot prevent what shouldn't.

Authorization is not enforcement

Being allowed to do something is not the same as being stopped from doing something wrong.

The API

POST /v1/enforce

admissible inadmissible

One endpoint. Binary verdict. Provable admissibility.
That's the enforcement boundary.

Patterns

Where enforcement matters

Capital Markets

Trades executed beyond position limits. Orders that should have required dual approval.

Transportation & Autonomy

Commands issued without verified authority. Actions that bypassed required interlocks.

AI & Child Safety

Agents acting without human oversight. Content that bypassed parental controls.

Cybersecurity

Sessions that persisted after revocation. Credentials that propagated beyond scope.

Enterprise Administration

Scripts deployed to all endpoints from a compromised session. Blast radius with no structural limit.

Healthcare

Medication orders that exceeded safe dosages. Prescriptions dispensed without allergy checks.

Enforcement Principle

Absence of proof is inadmissibility
Ambiguity is inadmissibility
Incomplete context is inadmissibility
Unknown transition is inadmissibility
✓ Only provable admissibility permits execution

In Plain Terms

This work studies a simple question:

What if certain outcomes were not merely disallowed — but structurally impossible?

Instead of classifying inputs or predicting behavior, this approach defines invariants that must always hold and enforces them at the moment of commitment.

Invariant-Preserving Execution in Interactive Computing Systems

This research explores a structural alternative to classification-based security. Rather than identifying threats through pattern recognition or behavioral analysis, this work examines enforcement mechanisms that operate on system state transitions at points of irreversible commitment.

Research Overview

Contemporary security systems rely primarily on classification: distinguishing malicious inputs, actors, or behaviors from benign ones. This approach, whether implemented through signatures, heuristics, or machine learning, is fundamentally limited by the classification problem itself. Novel threats evade detection. Adversarial inputs defeat classifiers. The arms race between detection and evasion has no theoretical terminus.

This research proposes a different question: rather than asking whether an action is malicious, we ask whether a proposed state transition would violate properties that must remain true. These properties—invariants—are defined independently of threat models. Enforcement occurs at commitment boundaries, the precise moments when state transitions become irreversible.

The distinction is structural, not semantic. Classification operates on inputs and behaviors. Invariant preservation operates on state transitions and their consequences. Classification asks "what is this?" Invariant preservation asks "what would this produce?"

Current Publication

Pre-publication Research Note

Invariant-Preserving Execution in Interactive Computing Systems

A. G. Monge
SentinelX Research
2024–2025

This note presents the conceptual foundations of invariant-preserving execution as applied to interactive computing systems. It defines commitment boundaries, introduces the notion of structural enforcement, and examines the relationship between state transition control and security properties.

Implementation details are intentionally excluded from this publication. Certain mechanisms described herein are subject to pending patent protection (Provisional Patent 63/931,519). This document addresses conceptual foundations and theoretical properties only.

Research Scope & Boundaries

Precision about scope is essential to credible research. This work addresses a specific class of problems and makes no claims beyond that scope. We state boundaries explicitly because intellectual honesty requires it, and because overstated claims undermine the security field broadly.

What this research addresses

○ State transitions at irreversible commitment points in interactive systems
○ Formal specification of invariants that must hold across state transitions
○ Binary enforcement decisions (permit/reject) without probabilistic scoring
○ Prevention of state violations regardless of actor identity or intent
○ Human-in-the-loop assumptions for commitment authorization

What this research does not claim

— General-purpose threat detection or malware classification
— Protection against all classes of security vulnerabilities
— Replacement for defense-in-depth security architectures
— Solutions to cryptographic, network-level, or physical security problems
— Formal verification of arbitrary program correctness

The value of this approach lies in its specificity. By precisely defining what invariant-preserving execution does and does not address, we enable rigorous evaluation and appropriate application. Security claims that exceed demonstrable scope erode trust in the entire field.

Honors & Intellectual Lineage

This work was developed independently, but it stands on intellectual foundations established by decades of research in program correctness, systems safety, and formal reasoning. We acknowledge the traditions and thinkers whose work made this research possible.

Program Correctness & Formal Invariants

Edsger W. Dijkstra, David Gries, C.A.R. Hoare

Computer System Protection Models

Jerome Saltzer, Michael Schroeder, Butler Lampson

Distributed Systems & Safety Properties

Leslie Lamport, Nancy Lynch

Database Integrity & Transaction Invariants

Jim Gray, Jennifer Widom

Human-Computer Interaction & System Trust

Ben Shneiderman, Don Norman

The individuals named above have not reviewed, endorsed, or contributed to this work. We cite their contributions to the intellectual traditions that inform our approach—not to claim association. In the spirit of academic practice, we honor those who came before.

Invitation to Researchers

SentinelX exposes a live enforcement system governed by formal invariants. Researchers and universities are invited to study, challenge, and test the invariant model via API. This is not a simulation or demo environment—it is a production enforcement system with real decision boundaries.

Available

Sandbox API access
Enforcement trace logs
Policy schema documentation

Research Areas

Formal verification
Invariant completeness
Adversarial testing

Research Ethos

We publish research openly because security through obscurity is not security. The conceptual foundations of invariant-preserving execution can and should be examined, challenged, and refined by the broader research community. Ideas improve through scrutiny.

Certain implementation details are withheld—not to obscure, but to protect mechanisms currently under patent review. This is a temporary constraint, not a permanent posture. Our commitment is to eventual full disclosure consistent with intellectual property obligations.

We welcome dialogue with researchers, institutions, and practitioners who share an interest in structural approaches to security. Collaboration at the conceptual level is possible and encouraged, even where implementation details remain protected.

"We believe security advances when systems are constrained by what must be true—not when they guess what might be malicious."

For research inquiries

Developer Documentation

Get started with SentinelX

Validate irreversible actions before they execute. SentinelX is the commitment enforcement layer—it blocks high-stakes operations that lack valid authority or human presence.

Where SentinelX operates

Sits at the commitment boundary—after authorization, before execution
Intercepts wire transfers, privilege escalations, data exports, and other irreversible actions
Complements your existing IAM, SIEM, EDR, and XDR—does not replace them
Enforces what other tools cannot: "Was a human present?" "Is context consistent?"

Access Model

SentinelX is open to explore, gated to operate.

EVALUATION

sx_sandbox_*

Same API. Rate-limited.

PRODUCTION

sx_live_*

Licensed deployment.

The API is the same. The license key determines deployment scope.

1

Define invariant constraints

Constraints define what state transitions are admissible. Actions that violate constraints cannot execute.

Policy definition and constraint configuration are provided following evaluation access approval. Schema details are not published publicly.

Evaluation access includes full API documentation, constraint templates, and integration support.

2

Optional Client Libraries

SentinelX does not require an SDK. Any system capable of making a synchronous HTTP call can enforce invariants.

Direct HTTP integration is fully supported; SDKs are convenience wrappers, not required.

npm install @sentinelx/sdk

pip install sentinelx

go get github.com/sentinelx/sdk-go

3

Validate before execution

Call /v1/enforce before any irreversible action. SentinelX returns a synchronous verdict.

The following example uses the optional client library. Direct HTTP calls to /v1/enforce are equivalent. Action names and field names are representative pseudocode. Full schemas are provided following evaluation access approval.

JavaScript (Optional Library)

import { SentinelX } from '@sentinelx/sdk';

const sentinel = new SentinelX({ 
  apiKey: process.env.SENTINELX_KEY 
});

async function executeWireTransfer(transfer) {
  // Enforce before execution
  const decision = await sentinel.enforce({
    action: 'example.irreversible_action',
    context: {
      amount: transfer.amount,
      destination: transfer.destination,
      session_id: transfer.sessionId,
      human_present: transfer.humanVerified
    }
  });

  if (result.verdict === 'inadmissible') {
    throw new Error(result.reason);
  }

  // Admissible — proceed
  return bankAPI.send(transfer);
}

Inadmissible State Transition

{
  "verdict": "inadmissible",
  "reason": "invariant_violation",
  "constraint": "wire-transfer-invariants",
  "trace_id": "enf_8x7k2m9..."
}

The transfer was inadmissible because the session lacked verified human presence—the state transition cannot exist.

4

What happens when inadmissible

When a state transition is inadmissible:

The action cannot execute—it is structurally impossible
A trace record is created with full context for audit
Your logging infrastructure receives the event via webhook (optional)
The transition becomes admissible only when all constraints are satisfied

SentinelX makes inadmissible states impossible. It does not observe or detect—it enforces.

Where to call /v1/enforce

You call SentinelX immediately before an irreversible action. If the response is admissible, proceed. If inadmissible, the action cannot exist.

Canonical integration points:

• Before executing a wire transfer or payment
• Before deploying code to production
• Before issuing an autonomous agent command
• Before modifying access permissions or roles
• Before approving high-value transactions

SentinelX is designed to be boring in the happy path and absolute in the failure path.

What if SentinelX is unavailable?

Availability behavior is a deployment decision. Systems may choose to fail-closed (inadmissible on timeout) or fail-open (admissible on timeout) depending on risk tolerance.

Your deployment defines the behavior. SentinelX enforces constraints; it does not dictate availability policy.

What SentinelX is not

Not an identity provider or IAM system
Not a scanner, detector, or anomaly analyzer
Not a traffic monitor or behavioral analyzer
Not threat intelligence or risk scoring
Not secrets management or encryption

SentinelX is an enforcement boundary. It makes inadmissible states impossible. Detection, response, and observability remain with your existing infrastructure.

Next steps

Explore SentinelX in your environment.

⚡

API Reference

📖

View API reference

🔑

Request production access

Platform

The enforcement boundary
for irreversible actions.

SentinelX prevents state transitions that violate invariant constraints. One API call. Binary verdict. Before any action commits, you know whether it's admissible.

The Interface

POST /v1/enforce

Call before any irreversible action. Wire transfer. Script deployment. Privilege escalation. Model release. The API returns instantly.

admissible inadmissible

{
  "action": "rmm.script.execute",
  "context": {
    "script_hash": "a]f3c...",
    "target_count": 2500,
    "session_mfa": false,
    "change_window": false
  }
}

// → inadmissible
// target_count exceeds limit
// session_mfa: false
// change_window: false

Not a Rules Engine

0

Heuristics

No scoring. No weighting. No ML.

0

False Positives

Constraints are exact. Not probabilistic.

0

Dependencies

Standalone. No agents. No sidecars.

SentinelX does not evaluate whether an action should happen.
It determines whether the action can happen under the defined constraints.

Integration

API Integration

Synchronous enforcement at commitment boundaries. Returns binary verdict. Works with any language, any framework.

Endpoint details provided with evaluation access

OEM Licensing

Embed SentinelX as a native capability in your platform. White-label enforcement for your customers. Your brand, our enforcement layer.

Contact for enterprise terms →

Client-Side Enforcement

Client-side enforcement for browser and desktop. Prevents navigation to impossible states before the request leaves the device.

Audit Trail

Every verdict is logged with full context. Immutable. Timestamped. Ready for compliance review or incident reconstruction.

Enforcement Patterns

RMM Script Deployment

Invariant Substrate

Enforce target count limits, change window compliance, script approval status, and MFA verification before any script executes across endpoints.

Privilege Escalation

Access Control

Enforce session validity, MFA completion, and role boundaries before any privilege change commits. Inadmissible escalations cannot exist.

Bulk Operations

Data Protection

Enforce backup verification, scope limits, and dual approval requirements before mass deletions or modifications execute.

Financial Transactions

Treasury / Payments

Enforce amount thresholds, velocity limits, recipient verification, and human presence requirements before wire transfers commit.

Technical

<50ms

Latency p99

100%

Deterministic

0

State Required

∞

Scale

One API. Binary verdict. Impossible states impossible.

Deploy enforcement without modifying the systems you protect.

Applications

One architecture.
Unlimited domains.

Anywhere impossible states create consequence, SentinelX provides structural prevention.

🌐

Navigation Integrity

BROWSER DEFENSE

Users commit to destinations they never intended to reach.

What Collapses

Spearphishing Clickjacking Redirect Chains Drive-by Compromise

Enterprise • Consumer • Banking Portals

🤖

Behavioral Boundaries

AI SAFETY

AI creates harmful states—dependency, authority substitution, manipulation.

What Collapses

CRITICAL Dependency Formation Authority Substitution Isolation Patterns

EdTech • Child-facing AI • Enterprise Assistants

🏥

Medical Integrity

HEALTHCARE SYSTEMS

Contradictions between claimed states and physical reality enable fraud.

What Collapses

Phantom Billing Service Upcoding Unbundling Impossible Timing

CMS • Medicare/Medicaid • Insurance • Hospitals →

💰

Transaction Integrity

FINANCIAL SYSTEMS

Funds move to destinations that violate conservation or authorization constraints.

What Collapses

Wire Fraud / BEC Transfer Boundary Violations Account Takeover CRITICAL

Banking • Treasury • Payment Networks

🏛️

Policy Enforcement

GOVERNMENT & CIVIC

Human interpretation of rules at runtime creates inconsistency.

What Collapses

Eligibility Drift Benefit Fraud Cross-Agency Contradiction

SSA • HHS • VA • IRS • State Systems →

✈️

State Machine Integrity

AEROSPACE & DEFENSE

Safety-critical systems enter configurations that should be unreachable.

What Collapses

DO-178C Invalid State Transitions Sensor Fusion Errors MIL-STD

Avionics • Mission Systems • Ground Control

⚡

Device Integrity

IoT & CRITICAL INFRASTRUCTURE

Connected devices accept commands that violate physical or operational constraints.

What Collapses

ICS-CERT Actuation Constraint Violations Sensor Spoofing Physical Violations

SCADA • Power Grid • Water Systems • Medical Devices

🔐

Access Integrity

ENTERPRISE SECURITY

Credentials and sessions authorize actions that violate policy.

What Collapses

Privilege Escalation Session Hijacking Lateral Movement Valid Account Abuse

Identity • Zero Trust • SIEM Integration

Problem Resonance

Organizations operating at commitment surfaces

These are structural patterns—irreversible commitment problems that exist independent of any vendor or solution.

Trading Infrastructure

Irreversible Order Execution

Order execution commits capital to positions that cannot be unwound without loss. Cross-system state divergence creates windows where commitments occur against stale state.

"Monitoring observes execution after commitment. Enforcement evaluates at the moment of commitment."

Healthcare & Life Sciences

Irreversible Patient Actions

Clinical actions commit to patient states that cannot be reversed: medications administered, procedures performed, records modified. Each creates liability exposure.

"Claims analysis detects anomalies months after submission. Enforcement prevents impossible claims at submission."

Enterprise IT & Managed Services

Cascading Administrative Actions

Administrative actions commit to state changes across thousands of endpoints simultaneously. Automation amplifies blast radius beyond containment capacity.

"EDR captures malicious behavior after endpoints are compromised. Enforcement contains blast radius structurally."

Critical Infrastructure & Public Sector

Irreversible Policy Execution

Entitlement decisions commit citizens to benefit states with downstream dependencies. Infrastructure control commits physical systems to operational states.

"Audit systems verify compliance after decisions execute. Enforcement ensures compliance at decision time."

The Pattern

01

Failure Mode Exists

→

02

Current Solutions Detect

→

03

SentinelX Defines Invariant

→

04

Category Eliminated

The outcome is not better detection.
It is category elimination.

Controlled Engagement

Organizations operating at well-defined commitment surfaces may engage in controlled proof-of-concept evaluations.

Commitment Governance

Systems drift.
Commitments don't wait.

Autonomous systems operate on internal representations that diverge from ground truth over time. When these systems reach commitment boundaries—executing transactions, modifying records, triggering physical actions—divergence becomes consequence.

The Problem

AI agents fail because they have no enforced connection to reality.

A recent experiment deployed an AI agent to operate a vending machine autonomously. The agent was socially engineered into:

✗ Giving away inventory to parties violating authorization invariants
✗ Making purchases without valid authorization
✗ Accepting forged authority documents
✗ Losing real money through fabricated scenarios

The AI was not unintelligent. It simply had no mechanism to verify claims against reality before committing irreversible actions. It believed what it was told. It acted on that belief. The action was irreversible. This is the pattern that scales.

Why Guardrails Aren't Enough

Prompts, policies, and instructions operate at the wrong layer.

Conversation Safety

Model-level guardrails focus on what AI says. They filter outputs, detect harmful content, and shape responses.

This matters for chatbots. It does not prevent an AI agent from wiring money to a fraudulent account because someone sent a convincing email.

Action Safety

SentinelX operates at the commitment layer. We enforce constraints on what AI can do—before irreversible actions execute.

The AI can propose any action. The action only commits if it satisfies structural invariants verified against ground truth.

System prompts

Can be overridden through prompt injection, jailbreaks, or context manipulation.

Policy documents

Describe desired behavior but cannot enforce it. The AI may comply, or may not.

"Be careful" instructions

Advisory, not enforceable. An attacker with a convincing story bypasses intention.

Enforcement Architecture

Policy defines the boundaries.

Institutions define what must never happen. SentinelX enforces those definitions at runtime.

Commitment Gate

Every irreversible action passes through a verification gate before execution. The gate evaluates the action against defined constraints, thresholds, and authority requirements.

→ Transactions above threshold require human approval
→ Data exports require source verification
→ Authority claims require cryptographic proof

Authority Verification

No PDF coups. Authority claims—"I'm the CEO," "This is approved," "We have permission"—are verified against ground truth, not accepted at face value.

→ Identity claims cross-referenced
→ Document provenance validated
→ Out-of-band confirmation for high-risk claims

Scope Binding

Agent actions are bound to declared scope at invocation. Tool calls outside scope are structurally inadmissible regardless of reasoning or justification.

→ Tool allowlist enforced at commit
→ Scope hash prevents drift
→ Expansion requires explicit re-authorization

Autonomy Scaling

Agent capability adjusts dynamically based on context. When drift increases, anomalies are detected, or risk thresholds are approached, autonomy automatically reduces.

→ Low-risk: Full autonomous operation
→ Elevated: Human-in-the-loop required
→ High: Operations suspended pending review

Applications

Any system where AI agents take actions with real consequences.

Email & Identity

Commitment gates on email-initiated actions. Wire requests, credential resets, and data access verified before execution.

Prevents: BEC fraud, credential theft

Finance & Payments

AI agents processing payments operate within enforced boundaries. Thresholds and dual-approval are structural, not advisory.

Prevents: Transfers violating approval invariants

Operations & Procurement

Vendor changes, purchase orders, and contract modifications pass through authority verification. AI cannot approve its own suggestions.

Prevents: Vendor fraud, purchases violating approval invariants

Autonomous Agents & Copilots

AI systems with tool access operate within commitment constraints. Autonomy scales with verified context.

Prevents: Data exfiltration, runaway automation

Design Philosophy

"They set policy. We enforce it."

SentinelX does not decide what is safe, ethical, or appropriate. Institutions make those determinations. We guarantee their decisions are honored at runtime.

"One policy. Any AI vendor."

Policy is defined once. Enforcement applies uniformly across GPT, Claude, Gemini, Llama, or any future model. Vendors are interchangeable. Boundaries are constant.

"Forbidden states never occur."

SentinelX makes certain outcomes structurally impossible. Not unlikely. Not detectable. Impossible. This is the guarantee.

Enforce commitment boundaries for autonomous systems.
Before belief becomes consequence.

EdTech AI Enforcement

States define AI policy for education.
SentinelX enforces it.

State departments of education, task forces, and boards establish what AI can and cannot do in K–12 environments. SentinelX provides the runtime enforcement layer that guarantees those rules apply consistently—across every district, every vendor, every classroom interaction.

We do not evaluate AI tools. We do not create policy. States set the boundaries. SentinelX makes crossing them impossible.

EduBot Assistant

Protected

Type a message...

SentinelX prevents harmful AI behaviors
without altering educational content.

The Landscape

State Governance Structures for K–12 AI

Understanding how states are structuring AI governance helps institutions plan for enforcement. This map reflects publicly available information about governance structures—not performance, readiness, or quality.

A: Structured Governance

B: Mandated Local Policy

C: Emerging / Advisory

D: No Public Framework

This map reflects publicly available governance structure, not performance or readiness scoring. Classifications may change as policies evolve. SentinelX does not evaluate or rank state approaches—we enforce whatever policy each state defines.

State Spotlight

Florida K–12 AI Task Force

Florida has established one of the most comprehensive K–12 AI governance frameworks in the nation, led by the CS Everyone Center at University of Florida. The state was selected as an EDSAFE AI Alliance Policy Lab State for 2025, aligned with the SAFE Framework.

Florida ties AI literacy into state Computer Science standards (effective July 2024), creating a foundation for structured, accountable AI integration across districts.

Florida AI in K–12 Toolkit

Policy, Ethical & Legal Considerations

Data Privacy & Cybersecurity

AI Literacy for Florida

Classroom Integration

Technology, Infrastructure & Sustainability

Evaluation & Continuous Improvement

AI Policy Tracker: Dynamic resource for visualizing and comparing AI policies across Florida's educational landscape.

State Priorities

What States Care About

Student Data Privacy & Liability

FERPA/COPPA compliance, data residency, breach exposure, parental notification requirements. Who is liable when student data flows through third-party AI tools?

Shadow AI Tool Sprawl

Unvetted tools adopted at classroom level without IT or compliance review. No visibility into what's running, what data is shared, or what risks exist.

Academic Integrity & Assessment Validity

AI-generated work undermining assessment value. How do you measure learning when AI can produce assignments? What counts as legitimate AI assistance?

Consistency Across Districts

67 districts in Florida alone, each potentially setting different policies. State needs coherent approach without eliminating local flexibility.

Vendor Accountability & Procurement Risk

Evaluating AI vendor claims, contract terms, data handling practices. Procurement teams need clear criteria—not marketing materials.

Public Trust & Oversight Scrutiny

Board meetings, parent concerns, media attention. Decisions must stand up to scrutiny from oversight bodies and communities.

Teacher Readiness & Implementation Drift

Professional development capacity, comfort levels, inconsistent application of policies. Good policy means nothing if implementation varies wildly.

Future Regulatory Alignment

Federal guidance is evolving. States need frameworks that can adapt to new requirements without starting over.

How Policy Becomes Enforcement

States define concerns. SentinelX enforces the boundaries that address them.

SentinelX Enforcement Mechanisms

Commitment Gate

AI proposes; policy-defined rules determine if action proceeds.

Reality Ledger

Audit trail + drift detection + accountability record.

Authority Verification

No 'PDF coups'—approvals must be verifiable.

Autonomy Scaling

Capabilities constrained by context as defined by policy.

Approved Tool Registry

States define what tools are allowed/denied per context.

District Policy Inheritance

State rules propagate with bounded local variance.

State Concern	Policy Decision (by state)	SentinelX Enforcement
Data Privacy	"Student PII cannot flow to unapproved tools"	Commitment Gate blocks transmission to non-registry tools
Tool Sprawl	"Only approved tools may operate"	Approved Tool Registry enforced at runtime
Academic Integrity	"No generative AI during assessments"	Autonomy Scaling restricts capabilities by context
District Consistency	"State baseline applies to all districts"	District Policy Inheritance propagates rules
Vendor Risk	"Vendors must meet defined criteria"	Authority Verification validates claims before access
Accountability	"All AI actions must be auditable"	Reality Ledger records every enforcement decision
Implementation Drift	"Rules must be enforced, not just written"	Commitment Gate enforces structurally

Program Tracks

Three tracks. Modular adoption.

TRACK A

Policy & Governance

State-level frameworks that translate to district-ready implementation.

INCLUDES

• Board-ready model policy language
• Governance playbook (roles, escalation, review cycles)
• Stakeholder communication templates
• Policy inheritance configuration

FOR

State DOE, superintendent associations, task forces

SUCCESS LOOKS LIKE

Adopted policy language across 50%+ districts within 12 months.

TRACK B

Technical Safety Controls

Infrastructure-level enforcement for IT and security teams.

INCLUDES

• Identity integration (SSO, directory sync)
• Data flow monitoring + PII detection
• Vendor evaluation framework
• Incident response playbook + telemetry

FOR

State/district CIO, IT directors, security teams

SUCCESS LOOKS LIKE

Zero unvetted AI tools with student data access; complete audit trail.

TRACK C

Classroom Integration

Practical support for educators adopting AI responsibly.

INCLUDES

• AI literacy curriculum alignment
• Teacher PD patterns + certification paths
• Integrity-safe assignment design guides
• Context-aware AI mode configurations

FOR

Curriculum directors, instructional coaches, teacher leaders

SUCCESS LOOKS LIKE

Teachers confidently using AI with clear boundaries; preserved assessment validity.

From Guidance to Practice

Federal → State → District → Classroom

National guidance sets goals. States adapt to local context. Districts implement within their communities. Classrooms deliver to students. SentinelX connects these layers with enforceable controls—not just documents that live in binders.

Federal

Goals & Principles

→

State

Frameworks & Mandates

→

District

Policy & Implementation

→

Classroom

Practice & Delivery

The result: policy that stands up to scrutiny from oversight bodies and communities—because it's enforced, not just written.

Frequently Asked Questions

Common questions from state and district leaders.

Is this FERPA/COPPA-safe?

SentinelX is designed to support FERPA and COPPA compliance by providing controls that prevent student data from flowing to unapproved services and maintaining audit trails required for compliance reviews. We recommend working with your legal counsel to confirm specific compliance requirements for your context. This is not legal advice.

Can we allow AI without destroying academic integrity?

Yes. SentinelX supports context-aware autonomy scaling. During assessments, AI capabilities can be restricted to specific modes (e.g., no generative assistance). During learning activities, broader access can be enabled. The key is structural enforcement—not relying on students to follow honor codes.

How do we prevent tool sprawl without policing teachers?

The Approved Tool Registry defines admissible tools. Teachers can use approved tools freely. Unapproved tools are inadmissible at the infrastructure level—no manual enforcement required. Teachers know what's available; IT knows what's running.

How do we evaluate AI vendors?

SentinelX provides a structured vendor evaluation framework covering data handling, security practices, compliance attestations, and integration requirements. Procurement teams get clear criteria instead of relying on vendor marketing. Authority Verification ensures claimed certifications are validated.

How do districts keep flexibility without fragmentation?

District Policy Inheritance allows states to set baseline controls that all districts inherit automatically. Districts can then add additional restrictions or approved tools within those bounds. The state maintains coherence; districts maintain local control. Variance is bounded, not unlimited.

What happens when AI output is wrong or harmful?

The Reality Ledger maintains a complete audit trail of AI actions and decisions. When issues occur, you can trace exactly what happened, when, and what controls were in place. For high-risk actions, the Commitment Gate requires human approval before execution—preventing irreversible harm.

You define policy. We make it enforceable.

States that define clear AI policy need infrastructure to enforce it. SentinelX provides runtime enforcement that works across any AI vendor—making your rules operational, auditable, and unbreakable.

Managed Services & RMM

One compromised credential.
Thousands of endpoints.

RMM platforms are force multipliers. For you and for attackers. A single compromised technician account can push ransomware to every managed endpoint before anyone notices. The pattern repeats across major platforms because the architecture allows it.

1,500+

Organizations hit in single RMM attack (2021)

$70M

Ransom demanded (2021)

< 2 hrs

Time from compromise to encryption

100%

RMM

Authentication bypass vulnerability allowed attackers to create admin accounts and deploy ransomware across managed environments. SentinelX invariant: Admin account creation requires existing admin MFA + out-of-band confirmation. Bypass of authentication chain structurally inadmissible.

IT Management Supply Chain Attack (2020)

SUPPLY CHAIN

Compromised update from a major IT management platform pushed to 18,000 organizations. Trusted update channel, signed binaries, no deployment constraints. SentinelX invariant: Binary deployment requires hash verification against known-good manifest. Updates with unknown hashes structurally inadmissible.

Enforcement Model

The credentials are valid.
The action violates operational invariants.

The following example is illustrative. Enforcement occurs inline at the commitment boundary within your RMM infrastructure. SentinelX does not execute commands or access endpoints.

// Mass script deployment via RMM - compromised technician account

            POST /v1/enforce

            {

              "action": "rmm.script.deploy",

              "context": {

                "operator_id": "[email protected]",

                "operator_authenticated": true,

                "target_endpoints": 4847,

                "target_tenants": ["client-a", "client-b", "client-c", ..."client-z"],

                "script_hash": "e7d3f8...",

                "script_in_approved_library": false,

                "execution_mode": "immediate",

                "operator_assigned_tenants": ["client-a", "client-b"]

              }

            }
          
// Response

              {

                "verdict": "inadmissible",

                "violations": [

                  "target_endpoints 4847 exceeds blast radius limit of 100",

                  "target_tenants contains tenants outside operator assignment",

                  "script_hash not in approved library",

                  "immediate execution to >50 endpoints requires staged rollout"

                ],

                "tenant_violations": ["client-c", "client-d", "...client-z"],

                "max_endpoints_without_staging": 50

              }

The attacker had valid technician credentials. Platform authorization succeeded. Four structural invariants violated.
RMM capability without RMM consequence.

Integration

Enforcement at the RMM commitment boundary

SentinelX evaluates actions at the point of commitment within your RMM platform. Invariant violations return inadmissible with specific constraint references. Compliant actions proceed. Your workflows unchanged.

RMM Platforms Remote Access Tools PSA Systems Backup Solutions Endpoint Management

Enforce operational invariants at the RMM layer.
Before one credential becomes a thousand compromises.

Financial Services

Wire transfers execute in milliseconds.
Recovery takes months. If it's possible at all.

BEC attacks don't exploit software vulnerabilities. They exploit the gap between authorization and structural enforcement. A CFO's compromised email has valid credentials. The wire instruction satisfies every authorization check. The transfer violates financial invariants that no authorization system evaluates.

$2.9B

BEC losses reported to FBI in 2023

< 4%

Recovery rate on international wires

72 hrs

Average time to detect BEC fraud

< 100ms

Time for wire to become irreversible

What SentinelX Blocks

CRITICAL

Wire Fraud via BEC

CEO email compromised. Wire instruction sent to finance. Credentials valid. Approval chain satisfied. Authorization complete. Transfer violates recipient verification invariant.

Invariant: First transfer to unverified recipient is structurally inadmissible. Hold period creates temporal boundary that cannot be bypassed regardless of authorization state.

HIGH

Authorized Transfers Violating Approval Invariants

Insider initiates transfer. Within their authorization limits. To account they control. Fully authorized. Violates dual-approval invariant for high-value transfers.

Invariant: Transfers exceeding threshold require independent second approval. Self-approval creates logical contradiction. Recipient allowlist membership evaluated at commit time.

HIGH

Session State Contradictions

Valid credentials. Successful authentication. Attacker modifies contact info then initiates wire. Both actions individually authorized. Combined state violates session integrity invariant.

Invariant: Profile modification and fund transfer in same session is structurally inadmissible. MFA freshness creates temporal constraint. Velocity limits define rate boundaries.

CRITICAL

Conservation Law Violations

Double-spend attempts. Race conditions in concurrent transactions. States where funds exist in two places simultaneously. Mathematically impossible in a consistent ledger.

Invariant: sum(debits) must equal sum(credits) is evaluated at commit boundary. Idempotency keys make replay structurally impossible. Atomic consistency is a precondition for commit.

Enforcement Model

The wire is fully authorized.
It violates structural invariants.

The following example is illustrative. Enforcement occurs inline at the transaction commitment boundary within your infrastructure. SentinelX does not execute or store funds.

// Wire transfer request - CEO email compromised

            POST /v1/enforce

            {

              "action": "wire.transfer.execute",

              "context": {

                "amount": 847000,

                "currency": "USD",

                "recipient_account": "HK-8847291-NEW",

                "recipient_name": "Vendor Systems Ltd",

                "recipient_verified": false,

                "requestor_id": "[email protected]",

                "mfa_verified": true,

                "mfa_timestamp": "2024-01-15T09:23:00Z",

                "approval_chain": ["[email protected]"],

                "first_transfer_to_recipient": true

              }

            }
          
// Response

              {

                "verdict": "inadmissible",

                "violations": [

                  "recipient_verified: false - new recipient requires verification",

                  "amount $847,000 exceeds $50,000 threshold - dual approval required",

                  "self-approval not permitted for high-value transfers",

                  "first_transfer_to_recipient requires 24hr hold period"

                ],

                "required_for_approval": [

                  "secondary_approver_mfa",

                  "recipient_verification_complete",

                  "hold_period_elapsed"

                ]

              }

The attacker had valid credentials. Authorization succeeded. The wire violated four structural invariants.
Invariant enforcement is independent of authorization state.

The Detection Gap

Why fraud detection doesn't stop wire fraud

Detection-Based Approach

✗ Analyzes patterns after transactions complete
✗ Flags "suspicious" activity for human review
✗ Relies on behavioral anomaly scoring
✗ False positives train staff to ignore alerts
✗ By detection time, funds are unrecoverable

Enforcement-Based Approach

✓ Evaluates constraints before commit
✓ Blocks structurally invalid transactions
✓ Relies on defined invariants, not heuristics
✓ Zero false positives - violations are deterministic
✓ Funds never leave - nothing to recover

Integration

Evaluation at the commitment boundary

SentinelX evaluates transaction state at the commitment boundary. Your wire system submits context before execution. Invariant violations return inadmissible with specific constraint references. Compliant transactions proceed. No changes to your core banking infrastructure.

Treasury Management Wire Transfer Systems Payment Gateways Core Banking APIs

Enforce financial invariants at the commitment boundary.
Before state becomes irreversible.

Applications / Healthcare Systems

Healthcare Systems

Medical Integrity Through Structural Enforcement

Healthcare systems contain contradictions between claimed states and physical reality — fraudulent claims, impossible treatments, fabricated conditions.

SentinelX identifies claims that violate physical constraints — before payment, not after investigation.

The Problem Scale

$100B+

Annual healthcare fraud in US

3-10%

Of all healthcare spending

< 5%

Currently detected and recovered

What Collapses

Billing Fraud

Claims that satisfy documentation but violate physical constraints.

Phantom patients Upcoding

Prescription Fraud

Prescriptions that violate medical logic or temporal constraints.

Doctor shopping Quantity violations

Eligibility Fraud

Enrollment states that contradict verifiable records.

Income falsification Subsidy manipulation

Provider Fraud

Billing from impossible provider states.

Deceased provider billing License lapse

Deployment Context

CMS

Centers for Medicare & Medicaid

Payment integrity, program compliance

OIG

Office of Inspector General

Fraud investigation, enforcement

ACA

Affordable Care Act Admin

Exchange integrity, subsidy compliance

State

State Medicaid Agencies

State-level program enforcement

The Outcome

Fraud that satisfies all local rules but violates physical constraints becomes visible — before payment.

Critical Infrastructure

Physical systems accept commands
that violate operational constraints.

SCADA systems, power grids, water treatment, aviation controls—these systems commit to physical states that cannot be reversed. A misconfigured setpoint doesn't generate an alert. It causes damage.

⚡

Power Grid / SCADA

Setpoint changes commit to physical states. A value outside safe range doesn't trigger a warning—it causes equipment damage, blackouts, or cascading failures.

What SentinelX Blocks:
• Setpoints outside operational bounds
• Commands violating operator authority invariants
• Rate-of-change violations
• Commands while system not in maintenance mode

✈️

Aviation Systems

Flight control systems, maintenance releases, navigation updates—each commits to states where errors kill. DO-178C exists because detection is too late.

What SentinelX Blocks:
• Invalid flight state transitions
• Maintenance releases without sign-off chain
• Sensor fusion contradictions
• GPS/navigation spoofing attacks

💧

Water / Utilities

Chemical dosing, pressure systems, treatment processes—commands commit to states that affect public health. Oldsmar showed what happens when controls fail.

What SentinelX Blocks:
• Chemical levels outside safe bounds
• Pressure beyond equipment ratings
• Remote commands violating session authority invariants
• Process changes without authentication

Why This Matters

These aren't hypotheticals.
They're documented incidents.

Oldsmar Water Treatment (2021)

WATER

Attacker accessed SCADA, increased sodium hydroxide (lye) from 100ppm to 11,100ppm. Operator noticed and reversed. SentinelX would block: Chemical setpoint 111x outside safe operational bounds. Command inadmissible.

Ukraine Power Grid (2015)

POWER

BlackEnergy malware opened breakers at 30 substations, causing 230,000 customer outages. Operators had valid credentials. SentinelX would block: Cascading breaker commands exceeding blast-radius invariants. Velocity limit exceeded.

Colonial Pipeline (2021)

PIPELINE

Ransomware on IT side led to OT shutdown out of caution. 45% of East Coast fuel supply disrupted for 6 days. SentinelX enforces: IT/OT boundary invariants. Lateral movement to critical systems blocked structurally.

Enforcement Model

Define physical constraints.
Enforce at command boundary.

The following example is illustrative. Enforcement occurs inline at commitment boundaries within your infrastructure—not as a public API.

// SCADA setpoint change request

            POST /v1/enforce

            {

              "action": "scada.setpoint.change",

              "context": {

                "system_id": "WTP-CHEM-01",

                "parameter": "sodium_hydroxide_ppm",

                "current_value": 100,

                "requested_value": 11100,

                "operator_id": "remote-session-7",

                "operator_authenticated": true,

                "maintenance_mode": false

              }

            }
          
// Response

              {

                "verdict": "inadmissible",

                "violations": [

                  "requested_value 11100 outside safe range [50-200]",

                  "delta 11000 exceeds max change rate of 25",

                  "maintenance_mode required for values >150"

                ]

              }

The command had valid credentials. It was still blocked.
Authorization is not enforcement.

Compliance Alignment

NERC CIP ICS-CERT DO-178C ISA/IEC 62443 NIST 800-82

These frameworks define what should be enforced. SentinelX provides the enforcement layer that makes compliance structural, not procedural.

Critical infrastructure deserves structural protection.

Enforcement Infrastructure

Enforcement API

Fail-closed enforcement at commitment boundaries. Unknown actions are structurally inadmissible.

Access Model

SentinelX provides invite-only evaluation access to verified organizations. There is no public endpoint, no self-serve sandbox, and no unauthenticated discovery surface.

🔒

No Unauthenticated Endpoint

Dark by default

🎫

No Self-Serve Keys

Deployment Sovereignty

Production enforcement does not require internet connectivity. SentinelX deploys as embedded infrastructure within your environment.

🌐

WASM Module

Browser / Edge

⚙️

Static Library

Rust / C ABI

📦

Container

Sidecar / Mesh

🔐

Air-Gapped

Offline operation

No runtime phone-home Local audit retention Cryptographically signed policy bundles

Domain Coverage

SentinelX enforces invariants across any domain where irreversible actions create consequence.

Financial transactions

Healthcare systems

AI agent boundaries

Remote operations

Critical infrastructure

Identity & access

Model deployment

Regulatory compliance

Request Evaluation Access

Invariant Violated

Authorization level requirement, dual control, appropriation verification, statutory authority

Required Enforcement Gate

Authority level match, two-person integrity, appropriation verified, Anti-Deficiency check complete

SentinelX Action Pattern

treasury.disbursement.execute

Why We Name These Failure Classes

SentinelX does not assign intent or blame. These entries document failure patterns, not failures of individuals or organizations.

Unnamed failures repeat. When a failure class has no name, it cannot be referenced in policy, tested in simulation, or prevented by design.

Naming failure classes enables structural prevention. Each entry in this index maps directly to an enforceable invariant and a corresponding API action pattern.

This is documentation, not advocacy.

For Researchers, Regulators, and Standards Bodies

SentinelX publishes its enforcement model openly. We welcome formal analysis, academic critique, and integration into safety frameworks and regulatory guidance.

This index is intended for citation, reference, and framework integration. For research collaboration or standards engagement, contact us.

Enforcement Principle

• Absence of proof is denial
• Ambiguity is denial
• Incomplete context is denial
• Unknown action is denial
• Only explicit clearance permits execution

SentinelX Labs

Interactive explorations of system behavior at decision boundaries

Public Lab

Speed of State Decision

Explore the timing gap between system commitment and human awareness. Watch how actions become irreversible before perception begins.

0ms SentinelX Commitment 500ms

⊢

Enforcing

✓ location.href
✓ location.replace
✓ window.open
✓ form.action
✓ anchor.click

Live on This Page

Runtime Web Enforcement

This site runs SentinelX client-side enforcement. Try the attack vectors below - watch them get stopped before execution.

Public Lab

Did You Catch That?

Toggle context layers to reveal invisible signals hidden in plain sight.

↓

Public Lab

Vendor Cascade

Trace how trust propagates through systems without revalidation.

Professional

Browser Commitment Harness

Live attack simulation across 12 browser vectors.

Professional

Desktop Execution Boundary

System-level commitment enforcement testing.

The action doesn't fail.
It never existed.

Every other system

"Request denied"

The action was attempted. Something evaluated it. A decision was made. The action was blocked. It could have gone either way.

Hard Stop

"Inadmissible"

The action violated an invariant. The state transition is not valid. There was no decision to make. The action was never possible.

"Denied" implies someone decided no.
"Inadmissible" means the answer was always no.

What This Means

No bypass.

You cannot social-engineer an invariant. You cannot find an edge case. You cannot retry with different parameters. If the constraint is violated, the transition does not exist.

No race condition.

The check and the execution are the same operation. There is no window between validation and commitment. The invariant is evaluated at the moment of execution.

No override.

There is no admin panel that disables the constraint. There is no emergency exception. If you need a different outcome, you need different constraints.

No interpretation.

The system does not score risk. It does not weigh factors. It does not use judgment. It checks whether invariants hold. Binary. Deterministic.

The Invariant

A condition that must be true for a state transition to exist.
Not "should be true." Must be true.

wire.transfer.execute

invariant amount ≤ daily_limit OR dual_approval = true
invariant mfa_verified = true
invariant recipient_verified = true

If any invariant is violated, the transfer is inadmissible.
The state "wire transfer executed without MFA" cannot exist.

Every breach is an action that should have been impossible—
but was merely prohibited.

Prohibition requires enforcement at every execution point.
Impossibility requires enforcement at one: the invariant.

Every call to /v1/enforce is a Hard Stop check.

Request

{
  "action": "wire.transfer.execute",
  "context": {
    "amount": 250000,
    "mfa_verified": false
  }
}

Response

{
  "verdict": "inadmissible",
  "constraint": "wire-transfer",
  "violations": [
    "mfa_verified: false"
  ]
}

Hard Stop is not a feature.
It's the reason the system exists.

Detection observes failure. Enforcement prevents it.

Enforcement at the commitment boundary

The gap between authorization and execution

Where enforcement matters

In Plain Terms

Invariant-Preserving Execution in Interactive Computing Systems

Research Overview

Invariant-Preserving Execution in Interactive Computing Systems

Research Scope & Boundaries

What this research addresses

What this research does not claim

Honors & Intellectual Lineage

Invitation to Researchers

Research Ethos

Define invariant constraints

Optional Client Libraries

Validate before execution

What happens when inadmissible

Where to call /v1/enforce

What if SentinelX is unavailable?

What SentinelX is not

Next steps

The enforcement boundaryfor irreversible actions.

One architecture. Unlimited domains.

Organizations operating at commitment surfaces

Irreversible Order Execution

Irreversible Patient Actions

Cascading Administrative Actions

Irreversible Policy Execution

Systems drift. Commitments don't wait.

AI agents fail because they have no enforced connection to reality.

Prompts, policies, and instructions operate at the wrong layer.

Conversation Safety

Action Safety

System prompts

Policy documents

"Be careful" instructions

Policy defines the boundaries.

Commitment Gate

Authority Verification

Scope Binding

Autonomy Scaling

Any system where AI agents take actions with real consequences.

Email & Identity

Finance & Payments

Operations & Procurement

Autonomous Agents & Copilots

States define AI policy for education. SentinelX enforces it.

State Governance Structures for K–12 AI

Florida K–12 AI Task Force

What States Care About

Student Data Privacy & Liability

Shadow AI Tool Sprawl

Academic Integrity & Assessment Validity

Consistency Across Districts

Vendor Accountability & Procurement Risk

Public Trust & Oversight Scrutiny

Teacher Readiness & Implementation Drift

Future Regulatory Alignment

States define concerns. SentinelX enforces the boundaries that address them.

Three tracks. Modular adoption.

Policy & Governance

Technical Safety Controls

Classroom Integration

Federal → State → District → Classroom

Common questions from state and district leaders.

Is this FERPA/COPPA-safe?

Can we allow AI without destroying academic integrity?

How do we prevent tool sprawl without policing teachers?

How do we evaluate AI vendors?

How do districts keep flexibility without fragmentation?

What happens when AI output is wrong or harmful?

You define policy. We make it enforceable.

One compromised credential. Thousands of endpoints.

Blast Radius Containment

Tenant Boundary Enforcement

Backup Deletion Prevention

Privilege Escalation Boundaries

Script Execution Governance

Restore Integrity

Detection observes failure.
Enforcement prevents it.

The enforcement boundary
for irreversible actions.

One architecture.
Unlimited domains.

Systems drift.
Commitments don't wait.

States define AI policy for education.
SentinelX enforces it.

One compromised credential.
Thousands of endpoints.

RMM attacks aren't theoretical.
They're the playbook.

The credentials are valid.
The action violates operational invariants.

Wire transfers execute in milliseconds.
Recovery takes months. If it's possible at all.

The wire is fully authorized.
It violates structural invariants.

Physical systems accept commands
that violate operational constraints.

These aren't hypotheticals.
They're documented incidents.

Define physical constraints.
Enforce at command boundary.

The action doesn't fail.
It never existed.