SG/Sentinel Developer-Friendliness And The Evidence Graph: What The Engine Knows, And Why That Makes Development Better

Summary

Developer-friendliness has a direct correlation with the quality of the code — a primary design objective, not a side effect. Its flagship feature: the evidence graph, a semantic, growing record of everything Sentinel currently knows about an IP, user or request, including why every decision was made — queryable as "what do you know about me?", a dev-only superpower excluded from production bundles by construction. Vault-per-user gives the graph a storage home with anonymity modes from know-nothing to know-everything, and the zero-knowledge property bounds its sensitivity: Sentinel knows what happened, never what was inside.

Key concepts

• The evidence graph — deferred, but the log record and request-id traceability are its wired-in first loop
• Dev-only insecure code is safe — the best way to keep code from being exploited in production is for it not to be there
• Every block has an inspectable reason — shipped in the MVP: reason and rule_id ride in every signal and record

Key ideas

• The LLM in the mix means checks that require interpretation are now tractable — out-of-band, on the analytical timeline.
• Wire the data loop first, enrich second: don't build the graph as a backend abstraction.
• Code often gets added to compensate for missing data; ask instead where the most efficient place to compute it is.

On this site

The "what do you know about me?" instinct survives in the MVP as blocks why and the read-only chat over live state.

Read the document