🛡️ SentinelAISecurity Analyst Portal

SentinelAI — AI Verification (on-device, optional)

The MVP decision path is deterministic rules (docs/RULES.md). This adds an optional AI layer that runs a small model on the end-user's laptop to cut false positives — without changing the low-friction, privacy-preserving story.

Principles

  1. Suppressor, not detector. The model may only downgrade a rules decision (block/warn → allow) when it is confident the match is a false positive. It can never raise a decision and never adds new detections. A wrong or slow model therefore cannot cause a leak.
  2. Hard matches are untouchable. Only fuzzy categories are suppressible: source_code, financial, contract. Secrets, SSNs, credit cards, and IBANs always block regardless of the AI (SUPPRESSIBLE_CATEGORIES in risk.py).
  3. Off by default. A toggle in the extension popup (aiVerify, stored in chrome.storage) turns it on. The demo stays pure-rules and deterministic unless you flip it.
  4. On-device + fail-safe. Inference runs locally via Ollama; prompt text never leaves the machine. Any error/timeout/absent model → "not a false positive" → the rules decision stands.

Flow

extension popup toggle ─▶ background.js adds {ai_verify:true} to /classify
agent: rules score ─▶ if decision∈{warn,block} AND category∈suppressible AND ai_verify:
        local SLM judge(text, category) ─▶ {false_positive, confidence, why}
        if false_positive AND confidence ≥ 70:  downgrade → allow (reason: ai_suppressed:…)

Model — "easily portable to a laptop"

Runtime Ollama (nothing to host; it just runs locally). Default model llama3.2:3b (Q4, ~2 GB, CPU-friendly, cross-platform). For lighter machines use llama3.2:1b or qwen2.5:1.5b. The task is a narrow binary judgment, so a 1–3B model is plenty.

Note: "Kimi" (Moonshot) is a large MoE, not an on-device SLM — not a fit for endpoints.

Enable it (per laptop)

# one-time
curl -fsSL https://ollama.com/install.sh | sh      # or the Ollama desktop app
ollama pull llama3.2:3b
# the agent auto-detects Ollama on 127.0.0.1:11434; then flip the popup toggle

Configuration (agent env)

Var Default Purpose
OLLAMA_URL http://127.0.0.1:11434 Ollama endpoint
OLLAMA_MODEL llama3.2:3b local model (swap for 1b/qwen to taste)
OLLAMA_TIMEOUT 5.0 seconds before falling back to rules
SENTINEL_AI_MIN_CONF 70 min confidence to suppress a false positive

Tailoring to your organization (Epic H1)

The base model only knows "familiar to the internet," not "proprietary to us." A per-org / per-department policy (agent/policy.json, keyed by SENTINEL_ORG_ID, default fallback) makes suppression org-aware. It is edited centrally and pushed to endpoints — laptops run inference only. Edits are picked up live (mtime reload, no agent restart).

{
  "default": {
    "context": "Kshetra Studio, a software/AI product company (engineering org).",
    "proprietary_markers": ["orion", "vega", "kshetra-internal", "projectx"],
    "public_hints": "Standard textbook algorithms and public/OSS code are NOT proprietary."
  }
}

Two effects:

  1. context + public_hints are injected into the judge prompt, so the model reasons for your org ("anything tied to Kshetra Studio is not a false positive").

  2. proprietary_markers are a hard guard: any text containing a marker is never suppressed, regardless of what the model says (the model isn't even called). Verified:

    Input Result
    public quicksort allow — ai_suppressed: public sorting algorithm (conf 90)
    def orion_deploy(...) block — policy:proprietary_marker 'orion' — not suppressed

Central distribution (agent fetches the bundle from the backend instead of a local file) is Epic H2.

Roadmap

  • Cloud option (deferred): route verification through the SaaS Lambda → Amazon Bedrock for laptops that can't run a local model. Trade-off: prompt text leaves the device, so it's opt-in per policy. The verify_false_positive interface is provider-agnostic, so this is an added implementation, not a rewrite.
  • Per-category confidence thresholds; user "was this wrong?" feedback to tune.