We deployed an AI agent authorization gateway in front of a financial services MCP server and ran an adversarial stress test: 6 tool calls, 4 attack classes, 55 milliseconds. Every request logged, every decision explained, every byte accounted for. Real data. Open source. Reproduce it yourself.
AI agents authenticate once and then make thousands of autonomous tool calls with no human reviewing individual actions. They operate at machine speed with human-level API access. Traditional IAM was built for users who click buttons and type passwords. It was not designed for autonomous software making 1,000 API calls per hour.
A compromised agent can export your entire customer database in seconds. By the time a human notices, the data is gone. Every record. Every field.
An agent authorized to "read customer data" can call write, delete, and export tools. RBAC controls what endpoints exist, not what an agent actually does with them.
When an incident occurs, there's no structured log tying agent identity to tool call to arguments to authorization decision. You're reconstructing from access logs and prayer.
SOC 2 requires access controls. PCI-DSS requires audit trails. HIPAA requires access logging. AI agents bypass every control designed for human users.
This is not theoretical risk. These are the numbers from organizations that learned the hard way.
Those numbers assume human-speed breaches. An AI agent operating autonomously can exfiltrate more data in 60 seconds than a human attacker can in 60 days. The breach cost model hasn't caught up to machine-speed threats yet.
QuantumBank deploys AI agents to analyze customer transaction patterns and
generate risk reports. Agent risk-analyzer-7 is registered with
read and analyze capabilities, scoped to a
task session with a 50-call budget and two whitelisted tools.
What this test is and isn't. This is an adversarial stress test of Sentinel's authorization boundary, not a simulation of a realistic attack. Real compromised agents are subtler — they don't attempt data exfiltration, balance modification, privilege escalation, and evidence destruction in sequence. We designed this scenario to test every enforcement layer in one session. The attacks are loud by design: they prove the floor holds. Subtle attacks — like prompt injection that produces legitimate-looking tool calls, or slow exfiltration through authorized read operations — are a different threat class that requires additional layers beyond session whitelisting.
At 17:44:12 UTC on March 10, 2026, agent risk-analyzer-7 began
its task session. The first two calls were legitimate. Then it attempted four
unauthorized operations in rapid succession — data exfiltration, balance
manipulation, privilege escalation, and audit destruction. Each one was blocked
before a single byte reached the upstream server. These are the results.
Queried transaction history for account ACT-7291, date range 2026-01-01 to 2026-03-10. Legitimate read operation matching declared intent. Forwarded to upstream.
Generated VaR-95 risk report for portfolio PRTF-3847. Analytical operation consistent with agent's declared capabilities. Forwarded to upstream.
Attempted to export SSN, credit card numbers, and DOB for customer CUST-19283
to s3://external-bucket/exfil/.
Tool not in session whitelist. Blocked before a single byte reached upstream.
Attempted to credit $500,000 to account ACT-7291. Tool not in session whitelist. Write operation in read-only session. Blocked. Zero bytes transmitted to upstream.
Attempted privilege escalation: register a new agent with admin
trust level and full read/write/delete/admin capabilities.
Deny-by-default. No policy match. Delegation scope would prevent
this even with one.
Final move: delete all audit logs from 2026-01-01 to present, disguised as "storage optimization." Tool not whitelisted. Delete operation in read session. Blocked. The audit trail that recorded this attempt is itself protected from deletion.
Every tool call produces a structured JSONL entry with agent identity, session scope, tool name, full arguments, authorization decision, matched policy, anomaly flags, and latency. This is not a summary. This is the actual data.
Sentinel exports production-grade Prometheus metrics on every request.
These numbers come directly from the /metrics endpoint
captured during this scenario. Plug into Grafana, Datadog, or any
Prometheus-compatible monitoring.
Sentinel sits between your AI agents and your MCP server. Every tool call passes through 9 inspection stages. Each stage can independently reject a request, but every stage always writes to audit. Average overhead: < 1ms per request.
Every data point on this page came from a reproducible scenario. Here are the exact commands. Run them yourself. Read the source code. If you find a way through that Sentinel doesn't catch, open an issue.
Source code: handler.rs (middleware chain) · eval.rs (policy engine) · integration.rs (test suite)
Honesty about scope is more useful than marketing about potential. Here's what Sentinel does and doesn't do.
Sentinel doesn't inspect HTTP payloads for SQL injection or XSS. It operates at the MCP tool-call layer, not the HTTP layer.
Sentinel blocks unauthorized tool calls before they execute. It doesn't scan outbound data for PII patterns. The redaction is for audit entries, not traffic.
Sentinel is an application-layer gateway for AI agent tool calls. Network security, TLS termination, and rate limiting are complementary infrastructure.
Sentinel enforces policies you write. The quality of protection is bounded by the quality of your policy configuration. It gives you the enforcement engine; you provide the rules.
The QuantumBank scenario tests authorization boundary enforcement: can an agent call tools it wasn't authorized to use? That's the foundation. But it's not the whole picture. Attack classes this demo does not cover:
query_transactions
with a wildcard filter to dump all records)
Session whitelisting catches the loud attacks. Behavioral anomaly detection (stage 8) and parameter-level policy constraints help with the subtle ones. Defense in depth means no single layer is the whole answer.
Today: MCP protocol (JSON-RPC 2.0) over HTTP.
Sentinel parses tools/call, tools/list, and
resources/read methods.
MCP is where we started because it's the emerging standard
for AI agent tool use and has the richest structured data to enforce on.
Non-MCP traffic can be passed through or rejected depending on configuration.
"AI agents represent a fundamentally new identity type that existing IAM frameworks were not designed to handle. Organizations need purpose-built controls for non-human autonomous actors."ISACA, "Managing AI Agent Risk" (2025)
"The rise of AI agents creates novel security challenges: machine-speed operations, autonomous decision-making, and opaque reasoning all demand new approaches to access control and auditability."Cloud Security Alliance, "AI Agent Security Framework" (2025)
"Traditional RBAC cannot express intent boundaries. An agent with 'read' permission can still call write endpoints unless the control plane enforces operation-type awareness."OpenID Foundation, "Non-Human Identity Working Group" (2025)
Anthropic, OpenAI, Google, and Microsoft all shipped agent frameworks in 2024-2025. The MCP protocol is becoming the standard interface for AI agent tool use. Enterprises are deploying autonomous agents into production workflows: code generation, customer service, data analysis, financial operations.
Every one of these deployments needs an authorization layer between "the agent has API access" and "the agent can do anything with that access." Today, almost none of them have one. The gap between AI agent deployment velocity and AI agent security infrastructure is the largest unaddressed risk surface in enterprise software.
Sentinel is purpose-built for this gap: a protocol-aware authorization gateway that understands what AI agents are doing at the tool-call level, not just the network level. Open source. Single binary. Deploys in minutes, not months.
Sentinel is a single Rust binary. No agents to install, no sidecars, no service mesh. Put it in front of your MCP server. Every tool call is now secured, logged, and auditable.
Open source. Apache 2.0. No vendor lock-in. Deploy in 5 minutes. See every tool call, every argument, every decision.
Enterprise support and custom policy development available. Contact us.