Sentinel for IT

See how Sentinel fits into your environment

Review the network path, follow one AI request, check released coverage, and plan a rollout.

  • Pick a reference environment.
  • See what is sent at each request step.
  • Check measured platform coverage.
  • Review published rollout information and open questions.

1 · Pick your environment

Trace the traffic path

Choose the reference design closest to your environment, then step through the path.

OFFICE LANone flat network · 192.168.1.0/24 INTERNET Router / UTMNAT · stateful Access switchand Wi-Fi Windows PCSentinel app Windows PCSentinel app Windows PCSentinel app Mac or LinuxSentinel CLI Printers NASfile shares HTTPS 443 · already redacted AI PROVIDERS OpenAI API Anthropic API Google Gemini SUPERWISE control planeSaaS · policy and metadata only HTTPS 443 · 60 s · metadata Prompt, after SentinelMetadata to SUPERWISELANSentinel on the device DWGSN-HLD-01TYPEHLD · NTSTITLESmall office, flat networkDRAWNSUPERWISE · solutions architectureREVADATE2026-10-14
Swipe to see the full diagramOpen the full-size diagram

Small business deployment notes

Available per user

The released Windows per-user app sends covered tools through Sentinel on loopback. Installation needs no admin rights.

2 · Follow one request

See what is sent where

Metadata only, never prompt or response content, goes to SUPERWISE.

AI tool or appClaude Code · SDK SUPERWISE Sentinelgateway Guardrail policyinside Sentinel AI providerOpenAI · Anthropic · Gemini SUPERWISE control planeSaaS 1 POST /anthropic/v1/messages 2 the whole prompt: every role, system prompt, tool results, history evaluate 3 secrets, then PII, then toxicity, in the configured order 4 verdict: Passed · Remediated · Blocked · Flagged 5 forward with values replaced by {{REDACTED}} · HTTPS 443 · caller's key 6 response streams back through Sentinel, unchanged (not scanned today) 7 metadata: time, route, model, outcome, hits, latency, tokens · no prompt text 8 policy changes ride the next heartbeat, within about a minute HTTP 127.0.0.1:8787 (on the PC) or HTTPS 443 (team gateway) On Blocked, the request stops at step 4; the tool receives the admin-set error Prompt pathResponseMetadata and policy DWGSN-LLD-03TYPELLD · NTSTITLEOne prompt, hop by hopDRAWNSUPERWISE · solutions architectureREVADATE2026-10-14
Swipe to see the full diagramOpen the full-size diagram

Prompt

The tool sends its request to Sentinel because its provider base URL points at the gateway. A tool that calls the provider directly is not checked.

3 · Coverage matrix

Check released coverage

13 coverage results

ToolPlatformStatusSetup note
Claude DesktopWindows appSupportedAnthropic's desktop app. On Windows, it requires an Anthropic API key. On macOS and Linux, it requires the Anthropic provider and a one-time browser sign-in.
Claude DesktopCLI on Mac and LinuxSupportedAnthropic's desktop app. On Windows, it requires an Anthropic API key. On macOS and Linux, it requires the Anthropic provider and a one-time browser sign-in.
Claude CodeWindows appSupportedAnthropic's terminal agent
Claude CodeCLI on Mac and LinuxSupportedAnthropic's terminal agent
Codex CLIWindows appSupported*Codex CLI: Supported on Windows, Mac and Linux when the tool uses an API key.
Codex CLICLI on Mac and LinuxSupported*Codex CLI: Supported on Windows, Mac and Linux when the tool uses an API key.
Your own apps and agentsWindows appSupportedOpenClaw, LangChain, or any framework
Your own apps and agentsCLI on Mac and LinuxSupportedOpenClaw, LangChain, or any framework
Antigravity (agy)Windows appSupported*Google's coding agent
Antigravity (agy)CLI on Mac and LinuxSupported*Google's coding agent
ClaudeBrowser extensionPreviewclaude.ai
ChatGPTBrowser extensionPreviewchatgpt.com
Gemini, Copilot, Grok, Perplexity, DeepSeekBrowser extensionComing soonIn development

*When the tool uses an API key. Signing in with a ChatGPT or Google account is not covered yet.

4 · Admin and rollout

Plan deployment and support

Per-user Windows install

The per-user installer needs no admin rights. It installs the local gateway service, tray app, Sentinel CLI, and settings that point covered tools at the gateway.

Policy and activity

Admins set the replacement text and block message. Each request records metadata with an outcome of Passed, Remediated, Blocked, or Flagged.

Managed rollout

The per-machine installer is preview and not publicly downloadable. Intune, Group Policy, and winget artifacts are preview or unreleased. Audit metadata is retained for one year while the account is active. Clean removal steps are not published.

5 · Questions IT asks

Published answers and open details

Proxy and TLS

Whether the gateway honors HTTPS_PROXY or works behind corporate TLS inspection is undocumented and untested.

Ports and egress hosts

The control-plane connection is outbound HTTPS every 60 seconds, and no inbound rule from SUPERWISE is needed. We do not publish a complete egress host allowlist.

Identity and enrollment

Team gateway identity is tenant-wide, not per user. Audit events do not identify the individual user. Sentinel-specific SAML setup is not verified, and SCIM and per-user audit identity are not built.

Data residency

Sentinel metadata goes to the SUPERWISE control plane on Google Cloud in us-central1.

Offline behavior

Sentinel is not available air-gapped. The gateway needs the SUPERWISE control plane for policy and status.

Performance overhead

We do not publish an added-latency figure.

Existing DLP and EDR

Sentinel can sit alongside existing SSE and DLP controls. We have not verified a specific EDR integration.

Failure behavior

General failure behavior is not published. The browser extension fails closed, while managed per-machine redirects remain when its service stops.

6 · Next step

Try one install or plan a fleet rollout

Install Sentinel

Plan a fleet rollout

Talk with us about deploying Sentinel across a fleet.

Talk to us

Sentinel Solo, Sentinel Pro, Sentinel Business

Back to Sentinel