The AI Decision Control Plane for regulated lending

Stop AI agents before they make the wrong call.

Sentinel is a decision gate that sits between your AI agents and real financial workflows. It evaluates every proposed action against policy, security, fair lending, explainability, and audit controls, then returns APPROVE, BLOCK, FLAG, or ESCALATE before execution.

Not observability. Not a registry. Enforcement — before execution.

Start in shadow mode. Graduate when the evidence earns it.

Apply as a design partner See the adoption path
11
stage security pipeline
< 5m
kill-switch drill
1.3 ms
p50 verdict latency
17
BFSI agent templates
Sentinel evaluation0.10 ms
AgentCOLLECTIONS_OUTREACH
PolicyReg F / FDCPA
GuardrailsPII redacted, no injection matched
Rule engine6 rules evaluated, 1 failed
VerdictBLOCK
Proofsha256:registry + rules + verdict
POST /api/v1/decisions/evaluate
{
  "agent_type": "COLLECTIONS_OUTREACH",
  "account_id": "A-55301",
  "calls_last_7_days": 8,
  "contact_hour_local": 13
}

verdict: BLOCK
reason: Reg F 12 CFR 1006.14(b)(2)(i) presumes a
  violation above 7 calls about one debt within 7
  consecutive days. 7 calls have already been
  placed, so this call would be the 8th.
Where to start

Start where a wrong answer is recoverable.

Most AI governance pitches lead with credit decisioning, which is the hardest place in the bank to put a new vendor inline — a wrong BLOCK is a denied applicant, and every control lands under ECOA adverse-action scrutiny. These four workflows decide nothing. They are also where agents are actually running today.

Reg Z · ECOA scope

Document intake

The agent extracts. It does not decide. A scope rule blocks an extraction agent that returns an approval, a limit or a rate — the point at which it has quietly become a credit model nobody validated.

See the controls →
Reg X · Reg Z

Loan servicing

Reg X is a set of clocks: acknowledge in 5 days, evaluate in 30, never refer to foreclosure while a complete loss mitigation application is pending. Dual tracking is the control that ends up in consent orders.

See the controls →
Reg F · FDCPA

Collections outreach

Reg F put a number on harassment: seven calls in seven days is presumptively fine, the eighth is not. An agent optimising for contact rate breaches it without ever doing anything its instructions forbade.

See the controls →
Reg E · Reg Z · FCRA

Dispute triage

Three regimes wearing one interface. A misrouted dispute does not fail loudly — it starts the wrong clock, and the deadline that actually applied passes unnoticed.

See the controls →

Credit decisioning is still the destination, not the starting line. The same gate that watches your servicing agent today evaluates LOAN_DECISION against ECOA, FCRA and QM when you are ready for it — same engine, same evidence, same audit chain. Thirteen credit-decisioning templates ship alongside these four.

In evaluation with risk & compliance teams · design partner slots open Digital Lender Regional Bank Credit Union also: Insurer Fintech

Placeholder marks — live customer logos pending design approval.

“An examiner can follow any AI decision end to end. That trace is the difference between a clean review and a finding.”
Chief Risk OfficerRegional Bank · illustrative
“ESCALATE means our models don’t have to choose between approve and block on the hard cases. A human stays in the loop where it matters.”
Head of ComplianceDigital Lender · illustrative
SOC 2 Type IINot started — see posture
ISO 27001Not started — see posture
Self-hostedZero data egress by default
Why Sentinel

The AI Decision Control Plane for regulated lending

A decision gate in the path of execution — built so every AI decision is examiner-defensible.

Enforcement in the path of execution

Inline decision gate, 1.3 ms p50 verdict, BLOCK before execute, deterministic verdict precedence.

Built for examination

Proof-of-Agent (SHA-256), examiner-readable reasons, Know Your Agent dossiers; mapped to NIST AI RMF, Treasury FS AI RMF, EU AI Act, SR 26-2, ECOA/FCRA/TILA, CFPB/OCC/Fed/FDIC.

Fair lending by construction

Disparate-impact and prohibited-factor detection, ECOA reason codes, QM 43% DTI checks, drift monitoring.

Your data stays yours

Self-hosted, zero data egress by default; SSO/SAML/OIDC, RBAC. No SOC 2 or ISO 27001 yet — our posture, stated plainly.

Adoption path

Start in shadow mode. Graduate when the evidence earns it.

No bank puts a new vendor inline with BLOCK authority on day one, and we do not ask you to. Governance mode is a per-agent setting: the same rules produce the same verdict in all three — only what gets enforced changes.

Step 01 · start here

Observe

Sentinel evaluates every decision and enforces nothing. Your agents run exactly as they do today, with zero enforcement risk. Two weeks later you have a report of what would have been caught, and which policy each breach hit.

caller sees  APPROVE
recorded    the real verdict
Step 02

Advisory

Flags and escalations are enforced, so human review starts working. Blocks are downgraded to flags and annotated, so nothing stops in production while you tune thresholds against your own traffic.

enforced  FLAG, ESCALATE
downgraded BLOCK → FLAG
Step 03 · destination

Enforce

The gate is live. A BLOCK stops the action before it executes, in the path of execution rather than after the fact. This is the differentiation — it is just not where a first deployment should start.

enforced  every verdict
latency   1.3 ms p50

Promotion is a governed event, not a config edit: it needs the policy-owner permission and a stated reason, and it lands on the audit chain with a named accountable owner. Reducing enforcement additionally requires an admin — turning a control off is the direction that deserves more friction, not less. The kill switch works in all three modes, because stopping an agent is a safety property rather than an enforcement one.

Decision Pipeline

Every agent action is treated as evidence.

Eleven stages of control, in the path of every lending decision — not a dashboard you read after the loss.

It is an inline decision gate with a complete, examiner-readable trace for every stage of control.

Select any stage to see what it does and where it lives in the docs.

What the security stages are

Detection of known attack families. Not a solved problem.

Stages 2 through 7 are deterministic pattern and keyword matching against hand-authored constants — no model call, which is what makes the latency achievable and the behaviour reproducible. It also bounds what they can do.

  • The injection scanner matches known attack shapes. Seven families, homoglyph normalisation, authored confidence values. A novel phrasing that matches no family passes it. We treat it as one layer, not a perimeter.
  • PII redaction is regex over 24 pattern families. It catches what those patterns describe and will miss formats they do not.
  • Toxicity and safety scoring are keyword and regex based, with weights we chose rather than parameters fitted to data. That makes them auditable and it makes them blunt.
  • The rule engine is the control that carries the weight. Security stages reduce the noise reaching it; your policy is what actually decides.

We measured it. Against a public benchmark the injection scanner has perfect precision and 3% recall — it is right when it fires, and it misses most attacks in that corpus. The numbers, the corpus, the misses and the two false-positive defects the eval found in our own product are all on the eval page. Treat these stages as defence in depth and size your policy accordingly.

Control Surfaces

Governance that runs in the path of execution.

Behavioral rules

Threshold, range, expression, list, regex, required-field, prohibited-field, conditional, and composite rules are evaluated before the agent can act.

Know Your Agent

A standing identity file for every AI agent — so you always know what each agent is allowed to do, on what data, under which rules.

Each agent gets an operational dossier: intended use, inferred data categories, template lineage, active rules, compliance tags, and explainability narrative.

Proof of Agent

A tamper-evident receipt on every decision — cryptographic proof of exactly which agent, rules, and config produced the verdict.

Each verdict carries SHA-256 bindings that tie the decision to registry state, rule state, and replayable audit strings.

Human escalation

High-risk decisions can move to an approval queue instead of being forced into a false binary approve/block flow.

Kill switch

Stop governed agents in minutes — global, by agent type, or by agent instance — without redeploying.

Checked first in the decision path. Activation and deactivation are retained on the audit chain with a named accountable owner.

Release-gated evals

Held-out cases with expected verdicts. A release does not ship unless the gate passes.

Pass rate, latency, and critical-regression thresholds fail the run before policy changes reach production.

Monthly QA sampling

Stratified samples of production decisions for human review. Disagreement rate is a board-visible metric.

Severe disagreements can be promoted into the eval set so tomorrow’s release gate catches today’s miss.

Tamper-evident audit chain

Append-only, hash-chained events — not just a log table examiners hope nobody edited.

Verify chain continuity and export a per-decision evidence bundle (decision + events + chain verification). Storage class: tamper-evident append-only (not WORM unless you place the DB on an immutable backend).

Security

Prompt injection defense

Seven attack families, including role manipulation, delimiter injection, data exfiltration, social engineering, homoglyph obfuscation, and multi-turn attacks.

Privacy

PII and PHI redaction

24 sensitive data types, including SSN, card numbers, IBAN, Aadhaar, PAN, passport, medical record numbers, API keys, and contact data.

Fair Lending

Bias and adverse action

Disparate impact checks, prohibited factor detection, ECOA reason codes, and drift monitoring for production credit workflows.

Observability

Agent traces

Sessions, traces, spans, token cost, p50/p95/p99 latency, throughput, error rates, and anomaly scores across the decision lifecycle.

Explainability

Examiner-readable reasons

Plain-English summaries, per-rule explanations, counterfactual suggestions, feature contributions, and complete decision paths.

Deployment

Self-hosted by default

FastAPI, SDK, LangChain integration, Docker, Helm, PostgreSQL persistence, API key auth, RBAC, and SSO/SAML/OIDC support.

Regulatory Coverage

Built for financial institutions that expect examination.

The product maps AI-agent behavior to the controls banks, lenders, insurers, and credit unions already have to defend.

FrameworkWhat it requiresHow Sentinel addresses itReference

NIST AI RMF

GOVERN, MAP, MEASURE, and MANAGE functions with documented controls and evidence.

All four functions mapped to concrete Sentinel controls — policy versioning and RBAC, agent classification, bias/drift/QA disagreement measurement, enforced guardrails, kill switches, and release-gated evals — each producing reportable evidence.

Brief →

Treasury FS AI RMF

230 control objectives across governance, data, validation, monitoring, third-party risk and consumer protection, each with compliance evidence examples. Published 19 February 2026. Non-binding.

Sentinel produces artefacts against each control area: versioned policy and RBAC, data-quality scoring per decision, release-gated eval sets, drift and QA-sampling metrics, a vendor register, and disparate-impact detection. It covers generative AI — the ground SR 26-2 vacated two months later.

Brief →

EU AI Act

Risk classification, transparency, human oversight, data quality, and logging for high-risk systems.

Four-tier risk classification, plain-English explainability for transparency, the ESCALATE verdict for human oversight, and full data-quality scoring and decision logging on every call.

Brief →

SR 26-2

Interagency guidance, issued 17 April 2026, superseding SR 11-7 and SR 21-8. Non-binding, and stated as most relevant to banking organizations over $30B in assets.

Model inventory with metadata, materiality-derived review cadence, release-gated validation before policy change, monthly QA sampling for ongoing monitoring, and a hash-chained audit trail tying every decision to the rules that produced it. SR 26-2 puts generative and agentic AI out of scope while ECOA, FCRA and TILA continue to apply in full — Sentinel governs the gap that leaves.

Brief →

ECOA / FCRA / TILA

Fair lending, specific adverse-action reasons, lawful credit-report use, and QM debt-to-income limits.

Disparate-impact and prohibited-factor detection, ECOA reason codes generated by the explainability module, FCRA-tagged rules, and QM 43% DTI checks enforced before the agent acts.

Brief →

CFPB / OCC / Fed / FDIC

Examiner-ready governance for AI-assisted lending, scoring, pricing, and line management.

Guidance-aware agent templates per use case, with examiner-readable decision traces and exportable compliance evidence aligned to each supervisor’s expectations.

Brief →
Architecture

A narrow gate between agents and consequences.

Sentinel integrates as an API, SDK, or LangChain guardrail. A proposed action enters on the left and only leaves as a verdict.

The agent proposes a decision with parameters, context, and optional RAG evidence. Kill switches are checked first, then guardrails and the rule engine produce one of four verdicts before execution. Every decision and governance action appends to a hash-chained audit store (verify continuity; export a per-decision evidence bundle). Persist to PostgreSQL for production; storage class is tamper-evident append-only.

Pricing

Tiers for scoping. Not a checkout.

Every plan includes the full pipeline; higher tiers add scale, retention, SSO, support, and deployment posture. Published so you can size a budget line — but in-path decision control is not something a bank should self-onboard into, and we do not offer it that way.

Design partners: custom

We are taking three, on bespoke commercial terms with pricing locked through the first renewal. If you are evaluating Sentinel for a real workflow, this is the route — not the table below.

See the programme
PlanPriceBest fitIncluded volume
CommunityFreeEvaluation, local testing, and early technical validation.
1,000 / month≈ a single analyst testing in a sandbox
Starterpilot scope$2,000 / moSized for a controlled pilot on one workflow — a single agent type, shadow or advisory mode. Not a production enforcement footprint.
25,000 / month≈ a 300-loan/day lender
Professional$5,000 / moMid-size banks and fintechs requiring SSO, observability, and one-year audit retention.
100,000 / month≈ a 1,200-decision/day lending desk
EnterpriseCustomLarge banks and insurers needing VPC or on-prem deployment, seven-year retention, and dedicated support.
Custom≈ multi-line-of-business, nationwide

What’s included, tier by tier

Scroll across to compare all four tiers →

Feature Community Starter Professional Enterprise
11-stage pipeline✓✓✓✓
BFSI agent templates3All 13All 13All 13
Kill switch / eval gates / QA sampling✓✓✓✓
Tamper-evident audit chain✓✓✓✓
Audit retention7 days90 days1 year7 years
Compliance exports—✓✓✓
SSO / SAML / OIDC——✓✓
Full observability suite——✓✓
VPC / on-prem deployment———✓
Dedicated support & SLACommunityEmailPriorityCSM + 99.9%

Every deployment starts in OBSERVE. Governance mode is a per-agent setting, and promotion to ENFORCE is a governed change requiring a policy owner, a stated reason, and an entry on the audit chain. No tier includes a path to inline BLOCK authority on signup, because that is not how this should be bought. See the adoption path.

Built by

The control layer he wished existed.

Sentinel is built by Abdul Mallick, founder of Integrity Stack. He has run model governance for consumer credit at Capital One, built bank stress-testing products and served as interim Chief Data Officer for a regulated bank’s wind-down, and currently advises the U.S. SEC on risk analytics. PhD in Engineering. Sentinel is the control layer he wished existed every time AI met an examiner.

Connect on LinkedIn
Get Started

Put a control plane in front of your AI agents.

We are taking three design partners. Ninety days, starting in shadow mode with zero enforcement risk — or inspect the API surface and verify an evidence bundle yourself first. The assistant in the corner is already running through Sentinel before it answers.

Design partner programme API documentation Launch console
IS

Governed Assistant

Sentinel-scored responses

Ask about Integrity Stack and Sentinel: regulated AI decisions, lending compliance, security controls, pricing, or deployment.

This assistant is governed by Sentinel itself. Each online answer is grounded in the regulatory corpus, screened for injection, redacted for PII, and scored for faithfulness before it reaches you.
What is Sentinel? Regulatory coverage CFPB on AI lending Compare: observe vs. enforce →