SG/Sentinel Consolidated Addendum: Prior Art, Cross-Cutting Observations, And Gap Resolutions
Summary
The bridge between the design series and the build: rather than retrofit fourteen briefs, one document captures the prior art to position against (OPA/Rego, Detection-as-Code/Sigma, deception technology, zero-trust), five cross-cutting observations (the three graphs are one; replay-from-S3 is the test corpus; Sentinel guards its own control plane; rule retirement is missing; the fingerprint is the spine), and the consolidated resolutions to every tabletop gap — fast-track as signed-token zero-trust acceleration, honeytoken-touch revoking trust, the known-good profile as a deploy artefact, per-target rate limiting, IP-escrow mode, and HTTP-level block actions.
Key concepts
- The gap resolutions — the corrected behavioural spec the MVP was built against
- The five observations — listed in full on the research page
- Honeytokens as the intent signal — IAM verifies identity; deception confirms intent
Key ideas
- Independent convergence on established disciplines is reassuring (the design is sound) and useful (mature implementations to learn from).
- Rule retirement: if a control covers a behaviour more efficiently than a rule, implement the control and save the compute.
- Production traffic stored replayably in S3 answers "would this new rule have blocked anything legitimate?" almost for free.
On this site
The single most-cited document on this site: the research page's prior-art and observations sections, and several roadmap rows, trace here.