SentinelAI — Architecture

AI-Powered Endpoint DLP for AI Tools Status: MVP · Confidential

1. MVP Focus

Real-time Data Loss Prevention (DLP) for web-based AI tools ("Copilots"): ChatGPT, Claude, Gemini, Microsoft Copilot, and M365 Copilot (web). The MVP intercepts prompts before they are sent to the AI provider, classifies the content locally, scores risk, and enforces an action (allow / warn / block) — with all sensitive analysis happening on the endpoint.

Event Collection decision (ADR-001): the MVP collects and enforces at the browser via a managed MV3 browser extension, not via TLS/API interception. See ADR below.

2. High-Level Architecture

┌─────────────────────────────────────────────────────────────────┐
│  ENDPOINT (Windows)                                               │
│                                                                   │
│  ┌───────────────────────────┐      ┌──────────────────────────┐ │
│  │  Browser Extension (MV3)  │      │  Local Agent (FastAPI)   │ │
│  │  ─ inject.js (page ctx)   │      │  ─ Classifier (rules)    │ │
│  │    monkeypatch fetch/XHR  │─────▶│  ─ Risk Engine (0–100)   │ │
│  │  ─ content.js (bridge)    │ HTTP │  ─ Local LLM (Ollama)    │ │
│  │  ─ background (SW)         │◀─────│  ─ Decision + reasons    │ │
│  │  ─ coaching popup UI       │ allow│                          │ │
│  └───────────────────────────┘ warn └───────────┬──────────────┘ │
│                                 block            │ telemetry      │
└──────────────────────────────────────────────────┼───────────────┘
                                                    │ HTTPS
                                                    ▼
┌─────────────────────────────────────────────────────────────────┐
│  CENTRAL PLATFORM — serverless, in your AWS (SaaS)               │
│  Lambda (FastAPI+Mangum, Function URL) ──► DynamoDB              │
│                     ▲                                            │
│  Static Next.js dashboard on S3 + CloudFront ──┘ (calls the API)│
└─────────────────────────────────────────────────────────────────┘

Deployment decision (ADR-002): the central platform is serverless — AWS Lambda + DynamoDB + static S3/CloudFront, deployed with AWS SAM. Chosen for low friction and zero-idle cost over containers/RDS. See ADR-002 below.

LLM decision (ADR-003): the MVP ships rules-only (no LLM) for low-friction rollout. The local endpoint LLM (Ollama) is a Phase-2 enhancement, SENTINEL_LLM=1. The cloud never runs inference. See ADR-003 below.

Design principle — thin sensor, local brain: the extension is a thin sensor + enforcer. All classification, LLM reasoning, and policy live in the local agent, so the same brain also serves future collectors (clipboard, file, USB, IDE) without duplicating logic.

3. Components

3.1 Browser Extension (extension/)

Interception flow:

1. inject.js wraps fetch/XHR. When a request targets a known AI completion endpoint, it extracts the prompt text from the body.
2. It postMessages the candidate to content.js, then awaits a decision (the wrapped fetch returns a pending promise).
3. content.js → background.js → POST http://127.0.0.1:8787/classify.
4. Decision returns: allow resumes the original request; warn shows a coaching overlay and resumes on user acknowledgement; block rejects the request and shows a block overlay.

Why the fetch hook (not just DOM hooks): patching fetch/XHR captures the actual outbound payload regardless of DOM redesigns, and lets us block by simply not forwarding the request. Keydown/send-button and paste hooks are secondary UX signals.

Deployment: force-installed via browser enterprise policy (ExtensionInstallForcelist for Chrome/Edge) so users cannot remove it.

3.2 Local Agent (agent/)

FastAPI service on 127.0.0.1:8787.

Latency budget: rules run synchronously (<5 ms). The LLM call is optional and used to refine borderline scores; if Ollama is unavailable or slow, the agent falls back to rules-only so enforcement never stalls.

Privacy: only a hash + truncated snippet + metadata are forwarded to the central platform by default. Full prompt capture is a policy-gated option (see Clarification Query #8).

3.3 Central Backend (backend/)

FastAPI on AWS Lambda (via Mangum) behind a Function URL; DynamoDB store. Endpoints:

• POST /api/events — ingest an endpoint decision event
• GET /api/events — event feed (dashboard), filterable by org/app/decision/category
• GET /api/stats — 7-day aggregates for overview tiles

DynamoDB single-table design (backend/app/repository.py): pk = ORG#<org_id>, sk = EVENT#<ts>#<id> — one partition per tenant, sorted by time. Stats aggregate the tenant's recent partition in the Lambda (fine at MVP volumes).

3.4 Dashboard (dashboard/)

Next.js static export (output: "export") hosted on S3 + CloudFront. It calls the backend Function URL client-side (NEXT_PUBLIC_API_URL, baked at build). No SSR server to run. MVP views: Overview stats, Event feed, Shadow-AI usage.

4. Data Model (MVP)

DynamoDB item (single table, per-tenant partition):

pk            "ORG#<org_id>"            -- tenant partition
sk            "EVENT#<ts>#<id>"         -- time-ordered within tenant
id            uuid
org_id        text                       -- tenant key (MVP: "default")
ts            iso8601
user          text                       -- endpoint user / SSO identity
host          text                       -- device hostname
app           text                       -- "chatgpt" | "claude" | "gemini" | "copilot" | "m365-copilot"
url           text
category      text                       -- pii | secret | source_code | financial | contract | none
risk_score    number                     -- 0–100
decision      text                       -- allow | warn | block
reasons       list                       -- matched rules / (Phase 2) LLM rationale
snippet_hash  text                       -- sha256 of matched content
snippet       text                       -- truncated + policy-gated

5. Risk & Enforcement Bands

Bands are configurable; defaults above are indicative (Clarification Query #6).

6. Tech Stack

7. Environments & CI/CD

Target: SaaS in your AWS account (Clarification #9 resolved). Deploy is sam deploy + aws s3 sync; auth is GitHub OIDC (no static keys). One-time bootstrap: sam deploy --guided locally (creates the OIDC role), then set repo vars AWS_DEPLOY_ROLE_ARN / AWS_REGION. Production is a separate CloudFormation stack (sentinelai-production) gated by the production GitHub Environment's required reviewers.

8. ADR-001 — Browser extension over API/TLS interception

Context: the MVP must do real-time DLP for web AI tools and block before send.

Options considered:

1. Browser extension (MV3) — hook fetch/XHR in page context.
2. Local TLS-inspecting proxy (MITM) — intercept HTTPS to provider APIs.
3. OS/UI Automation hooks — read app windows via Windows UIA.

Decision: Option 1 for the MVP.

Rationale:

• Sees prompt content decrypted, pre-send — no root CA install, no TLS interception.
• Cert pinning in desktop AI apps breaks MITM (Option 2); the extension avoids this entirely.
• One integration surface (the web UIs) covers all major web AI tools; no per-provider API schema reverse-engineering to maintain.
• Genuine real-time blocking by withholding the request.
• Enterprise-deployable and tamper-resistant via browser MDM policy.

Consequences / limits (tracked in backlog):

• Covers web AI tools only. IDE Copilot (VS Code/JetBrains) and Office/desktop Copilots are separate surfaces → Phase 2.
• Requires a managed browser; usage in an unmanaged browser is out of scope for MVP.

ADR-002 — Serverless (SAM) over containers/RDS

Context: the central platform must be low-friction and cheap at idle for the MVP SaaS.

Decision: AWS Lambda (FastAPI+Mangum, Function URL) + DynamoDB + static S3/CloudFront, deployed with AWS SAM. An earlier App Runner + RDS + Terraform draft was rejected as too heavy.

Rationale: zero-idle cost, no VPC/cluster/DB server to operate, one sam deploy, matches the team's serverless pattern. Consequence: DynamoDB access patterns (not SQL) — stats aggregate in the Lambda; revisit with a GSI or counters if event volume grows large.

ADR-003 — Rules-only MVP; LLM is Phase 2

Decision: ship the rules/regex classifier alone for the MVP. Rationale: a local per-endpoint LLM (Ollama + 4B model) means multi-GB installs and hardware requirements on every machine — the opposite of low-friction. Rules already catch secrets/PII/source/financial/contract with zero install. Consequence: contextual "is this proprietary?" judgment waits for Phase 2 (SENTINEL_LLM=1); the code path exists in agent/app/llm.py, off by default.

9. Out of Scope for MVP (see BACKLOG.md)

Clipboard/file/USB collectors · IDE Copilot · Office/desktop Copilots · attachment/file-upload DLP · local LLM refinement · SIEM integration · behavioral baselines · full-payload capture.