SG/Sentinel Interactivity And Deployment Phases: Two-Way Layer Invocation, Local-Everywhere, And Dev/Main/Prod Rules

Summary

"SG/Sentinel is not a spectator sport": every layer is individually invocable and the layers can be triggered in sequence from the front gate — essential in isolated deployments where the gateway may be the only reachable surface. The whole solution runs locally, identically to production. Dangerous dev-only rules (a rule that enables/disables other rules; bypass-all; full-state dump) are invaluable in development and phase-gated so they never reach production; the production bundle contains only the rules production runs. Rules promote dev → main (= QA) → prod, with main equalling production so what is tested is exactly what ships.

Key concepts

• Local-everywhere — realised in the MVP as targets B and C, fully offline
• Dangerous dev-only rules — maximum power in dev, minimum surface in prod — safe because bundles are phase-aware
• The value-equation inversion — security that the application controls, instead of a bolted-on thing that gets its teeth removed

Key ideas

• The traditional WAF failure mode, named: it breaks things, so it gets set to allow-all — decorative security.
• Never ship a rule to a live server that is not being invoked.
• Main-equals-production removes the gap between what was tested and what runs.

On this site

The three-target offline story and the deploy-parity language across the site come from here.

Read the document