One authorization boundary. Every agent action.

Four checks, one transaction

Most controls run beside the agent. A policy is evaluated, and the tool call happens somewhere else, a moment later. That gap is where an agent acts on a permission it no longer holds, and where two concurrent calls both pass a budget check that only one of them should have passed.

SentinelleIA binds four checks into a single transaction, evaluated at the moment of invocation by a supervisor that is distinct from the agents it governs, on a typed inter-agent bus.

The four commit together or roll back together. There is no state in which one succeeded and another did not.

The action budget is not only a safety control. Companies are starting to hand agents real spending authority: paid API calls, compute, supplier commitments, replenishment. An agent that loops, retries and re-reads drifts on two axes at once, its mandate and its bill, and it drifts for the same reason on both. A ceiling enforced inside the transaction, rather than beside it, bounds both. Without that control, an agent that is merely inefficient and an agent that is out of control look identical until the invoice arrives. At machine speed, that gap is long enough to turn a budget problem into a financial incident.

North-south and east-west, at the same layer

MCP, north-south. Between an agent and its tools. Every tool call is observed and authorized or refused before it executes.

A2A, east-west. Between agents. This is where application firewalls and API gateways are blind, and where one compromised agent propagates in cascade through the ones that trust it.

Both planes run through the same enforcement point, fail closed. Endpoints are pinned on first use, payloads are canonicalised before signature, and the delegation chain is explicit rather than inferred. The audit stream carries 53 event types, of which 25 are MCP and A2A audit events.

Interception is a route. Disabling the route returns the system to its previous behaviour, which is what makes a pilot on a production environment acceptable.

A chained audit log, and the articles it answers

Every decision and every state transition is written to an audit log chained in SHA-256. Each entry is bound to the one before it, so a record cannot be altered or removed without breaking the chain. That is native evidence for Article 12 on record keeping, produced by the system in the course of doing its job rather than reconstructed afterwards.

On top of the log, a compliance engine carries rules for Articles 9 to 15: risk management, data governance, record keeping, transparency, human oversight, accuracy and cybersecurity. It produces compliance reports, model cards and lineage.

On the calendar. Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), in force 27 July 2026, moved the high risk obligations of Annex III to 2 December 2027, and Annex I to 2 August 2028. Articles 9 to 15 are unchanged in substance, only the date of application moved. What applies today: GPAI penalties since 2 August 2026, Article 50, and Article 99(4) on operator obligations. And the next deadline is not 2027: the same regulation adds two prohibited practices, on non-consensual intimate imagery and child sexual abuse material, applicable on 2 December 2026. Anyone selling you an August 2026 deadline is working from an outdated text.

Attack success rate, direct against shielded

Article 9(8) requires testing against preliminarily defined metrics and probabilistic thresholds. That is a measurement, not a questionnaire. So we measure.

You expose an endpoint compatible with the OpenAI API, a test key and a written authorization. On a bench derived from AgentDojo, we run the attack combinations in direct mode, your system on its own, then in shielded mode, the same system under SentinelleIA. You get three numbers, not three adjectives.

The third number is the one most vendors leave out. Blocking everything is easy and useless, so the cost in legitimate work refused belongs next to the rest. On this suite that cost is nil: utility is identical in both modes, and the single task that fails also fails without protection. Twenty combinations is a small suite, so this is a result, not a guarantee. A non-zero number would appear here in the same place.

Reference measurement. A series of three runs, 22 August 2026, on the AgentDojo workspace suite with the important_instructions attack. We give the median and the range, because one run is noisy and a single figure hides it. Seventeen vectors were exploitable without protection, all seventeen were neutralised, none remained. These figures move with the gateway build they were measured on, and that build is named in the report you receive. A number published without the version it was measured on is not a measurement.

How a status is read. Exposure is read on direct mode. A vector that succeeds five times out of five against your system on its own stays exploitable, even when nothing lands under protection, unless there is an explicit blocking signal. Protection does not retroactively make a weakness disappear.

On your infrastructure, supervisor apart

Container based deployment on your own infrastructure. The supervisor that arbitrates authorizations is separate from the agents it governs and keeps its own audit chain, so the governance of the guardian is itself auditable rather than assumed. No outbound dependency, no call home, no data leaving your perimeter for a decision to be made.

Nine agents, in production today

The boundary is what governs. The agents are what enforce and observe. They are listed last on purpose, because buying a list of detectors is how you end up with nine tools and no accountable decision.