SentinelIQ: AI Agent Security Control Plane

Enterprises are deploying AI agents blind — no audit trail, no policy enforcement, no way to ask "what did my AI actually do last week?" SentinelIQ is an in-line security control plane between AI agents and the world. The DPI proxy intercepts every agent prompt and response synchronously. It enforces YAML policies with iptables-style semantics (priority-based conflict resolution, lexicographic tiebreaking) and flags intent mismatches. Actions include DENY, QUARANTINE, HUMAN_REVIEW, RATE_LIMIT, LOG, ALLOW with per-policy fail modes ensuring agents aren't silently blocked during outages. Built-in threat detection catches credential exfiltration (AWS keys, API tokens), PII leaks (SSN, email, phone), prompt injection, and jailbreak attempts. Every match includes threat category and pattern ID in metadata. Dual-mode evaluation: async policies complete under 3ms, blocking policies within configurable timeout (default 85ms). Timeout exceeded degrades to LOG — never silently drops traffic. Security at every layer: JWT auth with Cloud KMS signing (90-day rotation), bcrypt-hashed API keys, DEK-per-record envelope encryption (AES-256-GCM), Workload Identity for service auth. Two separate KMS key rings isolate signing from encryption. React dashboard provides real-time WebSocket feeds, risk heatmap from a materialized view, YAML policy editor with backtesting, spawn tree visualization up to 10 levels, and human review queue. Gemini RAG service ingests documents (PDF, DOCX, TXT, CSV) and answers natural-language audit queries with cited responses. One-click compliance reports map to HIPAA and SOC2 control IDs. Canary watchdog sends 8 adversarial payloads every 5 minutes verifying enforcement. Any mismatch fires P1 alert within 60 seconds. Canary results are themselves audited. Deploys as four Cloud Run services behind a private VPC, with CI/CD via GitHub Actions, property-based testing validating 22 correctness properties, and 50 golden test cases gating every deployment.