SentinelAI — Backlog
Confidential · Living document. Priorities: P0 (MVP must-have), P1 (MVP nice-to-have),
P2 (Phase 2), P3 (later).
Epic A — Browser Extension (MVP primary surface)
| ID |
Priority |
Item |
Notes |
| A1 |
P0 |
MV3 scaffold: manifest, background SW, content script, page-context inject |
Done in scaffold |
| A2 |
P0 |
fetch / XMLHttpRequest hook to intercept outbound prompts pre-send |
Core interception |
| A3 |
P0 |
Prompt extraction per provider (ChatGPT, Claude, Gemini, Copilot, M365) |
Endpoint + body shape map |
| A4 |
P0 |
Bridge page ↔ background ↔ local agent; await decision before send |
|
| A5 |
P0 |
Enforcement UX: allow (silent), warn (coaching overlay + ack), block (overlay) |
|
| A6 |
P1 |
Paste + send-button/Enter secondary hooks |
UX belt-and-suspenders |
| A7 |
P1 |
Popup: status, agent connectivity, recent decisions |
|
| A8 |
P1 |
Fail-safe mode when agent unreachable (fail-open vs fail-closed policy) |
Decision needed |
| A9 |
P1 |
Enterprise force-install policy docs (Chrome/Edge ExtensionInstallForcelist) |
|
| A10 |
P2 |
Firefox port |
|
Epic B — Local Agent (classification + risk brain)
| ID |
Priority |
Item |
Notes |
| B1 |
P0 |
FastAPI service on 127.0.0.1:8787, /classify + /health, CORS for extension |
Done in scaffold |
| B2 |
P0 |
Rules/regex classifier: PII, secrets/API keys, source code, financial, contract |
|
| B3 |
P0 |
Risk engine: sensitivity + destination → 0–100 + decision bands |
|
| B4 |
P1 |
On-device SLM (Ollama, Llama 3.2 3B) as false-positive suppressor + extension toggle |
Done — off by default; see docs/AI.md |
| B4b |
P2 |
Cloud verification option (Lambda → Bedrock) for laptops that can't run a local model |
Interface is provider-agnostic |
| B5 |
P1 |
Best-effort telemetry forwarder to central backend (hash + snippet + metadata) |
|
| B6 |
P1 |
Config file: bands, allow/deny lists, snippet-capture policy |
|
| B7 |
P2 |
Windows service packaging (pywin32) + auto-start |
|
| B8 |
P2 |
Model download/warm-up + health for Ollama |
|
Epic C — Central Platform (serverless: Lambda + DynamoDB)
| ID |
Priority |
Item |
Notes |
| C1 |
P0 |
FastAPI ingest POST /api/events, feed GET /api/events, GET /api/stats |
Done |
| C2 |
P0 |
DynamoDB single-table repository (per-tenant partition) |
Done (repository.py) |
| C2b |
P0 |
FastAPI on Lambda via Mangum + Function URL |
Done (main.py handler) |
| C3 |
P1 |
AuthN/Z for the API + dashboard (SSO + RBAC) |
Clarification #10 — currently open Function URL |
| C4 |
P1 |
Audit-trail export (CSV/JSON) |
|
| C5 |
P1 |
Enforce tenant isolation from auth (derive org_id from session, not client) |
org_id column done; enforcement pending C3 |
| C6 |
P2 |
Stats via GSI / counter items if volume outgrows in-Lambda aggregation |
ADR-002 consequence |
Epic D — Analyst Dashboard (Next.js)
| ID |
Priority |
Item |
Notes |
| D1 |
P0 |
Overview tiles: events, blocks, top risk apps |
Done (static export) |
| D2 |
P0 |
Event feed table with filters (app, decision, category) |
Feed done; UI filters pending |
| D6 |
P1 |
Auth in front of the static dashboard (CloudFront + Cognito/OIDC) |
Ties to C3 |
| D3 |
P1 |
Shadow-AI usage view |
|
| D4 |
P1 |
Risk trends over time |
|
| D5 |
P2 |
Per-user risk profiles |
|
Epic H — AI tailoring (make suppression org/department-aware)
Base Ollama has no knowledge of the org; it judges "familiar to the internet," not "proprietary to
us." Tailoring is authored centrally and pushed to endpoints (laptops run inference only). See
docs/AI.md. Sequenced easiest→heaviest.
| ID |
Priority |
Item |
Notes |
| H1 |
P1 |
Policy context in the judge prompt — per org/department context + proprietary markers (hard "never suppress") + public hints |
Done |
| H2 |
P2 |
Central policy distribution — agent fetches org/department policy bundle from backend (GET /api/policy?org=&dept=), cached; edited centrally |
H1 uses a local file first. See docs/TAILORING.md |
| H3 |
P1 |
Feedback capture — analyst marks events "should've blocked / was fine" on the dashboard; labels stored |
Done (labels stored; do not yet influence decisions) |
| H3b |
P1 |
Feedback → few-shot — inject the org's recent analyst corrections into the judge prompt as examples, so "correct a decision → it adapts" works without any training |
The missing rung between H3 and H5; highest-leverage, lowest-risk "learning" |
| H4 |
P2 |
Grounding lists — allow (published OSS) / deny (codenames, internal domains, employee names) as hard signals |
|
| H5 |
P3 |
LoRA fine-tune on labeled feedback (central box) + adapter OTA to agents |
Needs H3 data + GPU + privacy review. Per-org, not per-dept |
| H6 |
P3 |
Versioned model/policy OTA bundle per org/department |
Ties to H2/H5 |
| H7 |
P2 |
Department routing — resolve the user's department (identity/SSO or per-endpoint config) and apply that dept's policy bundle + thresholds |
Config, not training. Needs auth (#10) for trusted claims. See docs/TAILORING.md |
Epic E — CI/CD & Infra
| ID |
Priority |
Item |
Notes |
| E1 |
P0 |
CI: test agent+backend, static-build dashboard, package extension |
Done |
| E2 |
P0 |
SAM template.yaml (Lambda + DynamoDB + S3/CloudFront + OIDC role) |
Done; validated with sam validate --lint |
| E3 |
P0 |
Staging pipeline on main (sam deploy + dashboard sync) via OIDC |
Done |
| E4 |
P0 |
Prod pipeline (separate stack) with approval gate |
Done |
| E5 |
P0 |
One-time bootstrap + repo-var wiring |
Done — staging live in account 835422347653 |
| E6 |
P1 |
Set repo vars AWS_DEPLOY_ROLE_ARN, AWS_REGION |
Done (via bootstrap) |
| E9 |
P2 |
Bootstrap prod stack (sentinelai-production) + production env reviewers |
Pending |
| E7 |
P1 |
Scope down the OIDC deploy role to least-privilege |
Done — resource-scoped inline policy, no *FullAccess/IAMFullAccess |
| E8 |
P2 |
Signed extension packaging + store/enterprise distribution |
|
Epic F — Event Collection Strategy (recorded)
Captures the ADR-001 decision and the deferred collection surfaces. See
ARCHITECTURE.md §8.
| ID |
Priority |
Item |
Notes |
| F1 |
P0 |
Decision: browser extension as MVP collection + enforcement point |
ADR-001 |
| F2 |
P2 |
IDE Copilot collector (VS Code / JetBrains extension) |
Different surface; code exfil focus |
| F3 |
P2 |
Office / desktop Copilot (Windows UI Automation or MS Purview) |
Native apps |
| F4 |
P2 |
ChatGPT / Claude desktop apps (process detect + clipboard + UIA) |
Native apps |
| F5 |
P3 |
Clipboard collector |
From original spec |
| F6 |
P3 |
File-system collector (downloads/documents) |
From original spec |
| F7 |
P3 |
USB insert detection (WMI) |
From original spec |
| F8 |
P3 |
Evaluate TLS/API interception for native apps only |
Rejected for MVP (cert pinning, maintenance) |
Epic G — Attachment / file-upload DLP (raised by sponsor, not in MVP)
Current interception reads prompt text from JSON request bodies. File attachments (drag-drop
PDFs/spreadsheets/images into ChatGPT/Claude, paste screenshots, upload docs to Copilot) go through
a separate multipart/form-data upload path the current hook does not inspect. This is
genuinely harder and is Phase 2 (the original spec parked "browser upload blocking" + "screen
OCR" there too).
| ID |
Priority |
Item |
Notes |
| G1 |
P2 |
Intercept file-upload requests (FormData / upload endpoints) per provider |
New surface in inject.js |
| G2 |
P2 |
Extract + classify file content (text extraction; OCR for images) before upload completes |
Agent-side; likely needs the LLM/OCR |
| G3 |
P2 |
Block/warn on attachment uploads (real-time) |
Ties to enforcement UX A5 |
| G4 |
P3 |
Size/type policy (e.g. block >N MB, block source archives) |
|
Epic I — Packaging, distribution & hardening
The self-contained Windows package (SentinelAI-Windows.zip with sentinelai-agent.exe) works, but
is unsigned and served from a public URL. Items to make it distribution-grade.
| ID |
Priority |
Item |
Notes |
| I1 |
P1 |
Code-sign the exe + PowerShell installer (Authenticode / EV cert) |
Removes SmartScreen "unknown publisher" + most AV false positives |
| I2 |
P1 |
Gate the download — auth or short-lived/expiring link instead of a public URL |
Today: dlp.kshetra.studio/download/… is world-readable; use S3 presigned URLs or Cognito/basic-auth |
| I3 |
P2 |
Wrap the installer in a real MSI/Inno installer (double-click, Add/Remove Programs) |
Nicer than "run the .ps1" for non-technical users |
| I4 |
P2 |
Auto-warm the model on install/login so the first AI prompt isn't a cold ~10s |
Warm-up call after ollama serve; or ship llama3.2:1b on low-spec machines |
| I5 |
P2 |
Attach the exe to a GitHub Release for a stable, versioned download |
build-windows-agent.yml already runs on release |
| I6 |
P3 |
macOS signing + notarization for the agent + a .pkg installer |
Parallel to I1/I3 for Mac endpoints |
| I7 |
P3 |
Windows service (pywin32/NSSM) instead of a logon/startup Scheduled Task for fleet |
Runs without an interactive session |
Decisions locked (2026-08-10)
- LLM (ADR-003): MVP is rules-only; local endpoint LLM is Phase 2 (
SENTINEL_LLM=1).
- Deployment (#9 / ADR-002): SaaS in the user's AWS, serverless (SAM + Lambda + DynamoDB +
static S3/CloudFront).
Open Questions (still need sponsor input)
- #6 Policy ownership — hardcoded defaults vs admin-configurable thresholds. Blocks B6.
- #8 Data egress — metadata-only vs full-payload capture. Blocks B5, privacy review.
- #10 Auth model — SSO/RBAC for API + dashboard. Blocks C3/C5/D6. (API is an open Function URL until then.)
- A8 Fail mode — fail-open vs fail-closed when the local agent is unreachable.
- Attachments (Epic G) — confirm Phase-2 priority vs pulling G1–G3 forward.