IAGA Sentinel: A Deterministic Multi-Layer Runtime for Zero-Trust AI Agent Governance
Abstract
Autonomous AI agents are increasingly deployed with direct access to shell environments, file systems, databases, and external APIs, yet governance mechanisms remain either binary (allow/deny) or rely on opaque ML-based classifiers. We present IAGA Sentinel, a zero-trust security runtime implemented in 8,600 lines of Rust that interposes an 8-layer deterministic governance pipeline between the agent and its execution environment. Each layer produces an independent numeric risk contribution (0–100) feeding into a weighted composite scorer, replacing flat binary decisions with continuous, interpretable threat quantification across three decision bands: ALLOW (0–34), REVIEW (35–69), and BLOCK (70–100). We evaluate IAGA Sentinel on a primary suite of 800 governance requests across 16 scenarios and 9 attack categories, achieving 99.8% decision accuracy, zero false positives on benign actions, continuous risk scores from 1 to 88 with intuitive threat hierarchy, and sub-3 ms governance pipeline latency. We extend the evaluation with 5 obfuscation scenarios for a total of 1,050 requests; the production pipeline yields zero ALLOW bypasses on this extension. A targeted ablation that disables the firewall's signature-scan stage quantifies defense-in-depth: 50 of 250 obfuscation requests (20%) bypass to ALLOW with the stage removed, while 200 are still contained by overlapping detection from the threat-intelligence and policy layers. A composite-weight perturbation analysis bounds the system's sensitivity to weight choice within 1.24 percentage points across 8 configurations. IAGA Sentinel is source-available under the Business Source License 1.1.
Keywords: AI agent security, Zero-trust runtime, Composite risk scoring, Prompt injection, MCP governance