Executive Posture
Unified posture across commit scanning, pipeline gates, AI agent policy and operational exposure. Objective: shorten the path from risky commit to understood risk to remediation.
Scan volume & blocked events - 14 days
Security posture
Latest critical events live
SLA & remediation debt
Commit Risk Triage
Every push and merge request is scanned on webhook delivery (HMAC-verified). AI verdicts below are ranked by composite risk. Click a row for the full reasoning trace.
| Commit | Repository | Author | Threat class | Severity | AI confidence | Decision | Age |
|---|
AI Fix Engine
Paste code, a diff, a Dockerfile, CI config or requirements file. The multi-layer analyzer runs secret scanning, supply-chain checks, injection/obfuscation detection and exfiltration path analysis - locally, in your browser.
Prompt Shield Studio
The runtime firewall for agentic AI. Every prompt, retrieved document and tool output is screened before it reaches your agents: 14 deterministic detectors plus a GPT-5.6 intent pass. Verdicts - PASS - SANITIZE - BLOCK - land in the same audit trail as code scans.
Pipeline Gate Center
Policy-as-code meets AI reasoning. Every stage decision is explainable: which policy fired, what the model concluded, and what unblocks the pipeline.
Agent Security Console
AI agents are actors, not just tools. Every tool call is evaluated against execution policy before it runs: sandboxed, approved, denied or escalated - with a full decision trace.
| Agent | Requested action | Tool call | Risk | Policy result | Outcome |
|---|
Live agent timeline
Denied operations - 24h
Threat & Exposure Watch
Security does not stop at the diff. Internet exposure, KEV-listed vulnerabilities, patch debt and backup integrity weigh on the same posture score as code findings.
EXPLOITED IN THE WILD Live CISA Known-Exploited-Vulnerabilities catalog connecting...
Internet-exposed services
Ransomware-linked KEV - nearest remediation deadlines
Patch & hypervisor state
Backup & recovery assurance
NIST Governance Center
Every finding is mapped to NIST CSF 2.0 functions with an owner, an SLA and evidence. Governance means the risk has a name attached to it - not just a severity.
| Finding | CSF 2.0 function | Category | Owner | SLA | Evidence | Status |
|---|
Security Digital Twin
Operational Resilience Maturity Assessment across 10 domains, on a 5-level scale. Run the tests per domain: check the criteria you meet, and the maturity level, gap-to-target and roadmap update live. Modelled on the CDPQ operational-resilience framework.
Maturity scale
Roadmap - largest gaps first
Evidence & Audit Trail
Immutable log of every gate decision: trigger, policy applied, model justification, human approval and produced artifacts. Built for internal audit and CISO reporting.
| Timestamp | Trigger | Repo / subject | Policy | Decision | Approver | Evidence |
|---|
Help & Docs
How Guardian Sentinels works, what each module does, and how the scoring gate reaches a decision. Everything here reflects the live engine, not marketing copy.
âš¡ Quick start
- Go to Code Gate and pick a demo sample (or paste your own code, diff, Dockerfile or CI file).
- Click Run deep analysis. The engine runs 7 layers, then returns a verdict: Allow / Review / Block / Quarantine.
- When served from the backend, the verdict is confirmed by the configured reasoning engine and written to the Evidence & Audit Trail with an EV-... id.
- Review governance in NIST Governance Center; export the trail for auditors from Evidence & Audit Trail.
🧠The 9 modules
- Executive Posture
- Posture score, scan volume, blocked pipelines, SLA debt and a prioritized feed of the latest critical events.
- Code Gate
- Incoming commits ranked by composite risk. Click a row for the diff, triggered rules, MITRE ATT&CK mapping and the recommended decision.
- Code Gate
- The live analysis studio. Deterministic engine + OpenAI reasoning -> an explained Allow/Review/Block/Quarantine verdict.
- Pipeline Gate Center
- Every CI/CD stage with its status and the reason a pipeline was blocked - policy-as-code meets AI reasoning.
- Agent Security Console
- AI agents as monitored actors: each tool call is evaluated by policy before it runs (Allow / Sandbox / Escalate / Deny).
- Threat & Exposure Watch
- Operational exposure beyond code: internet surface, KEV, ransomware-linked alerts, patch debt and backup assurance.
- NIST Governance Center
- Each finding mapped to NIST CSF 2.0 (Govern/Identify/Protect/Detect/Respond/Recover) with owner, SLA and evidence.
- Evidence & Audit Trail
- Immutable, exportable log of every decision - built for internal audit, compliance and CISO reporting.
🎯 Board priorities
Findings feed a composite score across six axes. The decision is driven by the number and class of findings, not just the total:
| Verdict | Triggered when |
|---|---|
| QUARANTINE | >=2 critical, or a critical supply-chain / exfiltration signal - artifact is isolated from any build. |
| BLOCK | >=1 critical finding, or composite risk >= 55 - merge blocked pending fix. |
| REVIEW | >=1 high finding, or accumulated mediums (risk >= 25) - human review required. |
| ALLOW | Only low-impact hygiene findings, or nothing detected - allowed with annotations. |
Axes: code - supply chain - exfiltration - exposure - AI-agent - business urgency.
ðŸ›¡ï¸ Control coverage
36 deterministic rules across these classes, each mapped to MITRE ATT&CK where applicable, plus an AI intent pass on top.
🤖 Engine status
Open the HTML file directly and the studio uses the in-browser analyzer. Serve it from the FastAPI backend with a GEMINI_API_KEY and verdicts are confirmed by gemini-2.5-flash and persisted.
âŒ¨ï¸ Shortcuts & tips
- Esc
- Close the detail drawer.
- Global search
- Type in the top search box to filter commits in Triage instantly.
- Theme
- Toggle dark/light with the â— button in the header; your choice is remembered.
- Deep-link
- Every module has a URL hash (e.g. #agents) you can bookmark or share.
â“ Board notes
- Is the analysis real or simulated?
- The analysis engine, OpenAI reasoning, agent policy and audit trail are real and computed live. The dashboard KPIs (posture score, weekly counts) are credible demo data for presentation.
- Is this safe to run against real code?
- Yes - it performs static pattern analysis only. It never executes the code it inspects. Use it for defensive security testing and secure development.
- What happens to a leaked secret I paste?
- It is scanned in-process and, if backend-served, a redacted finding + evidence id is stored locally in SQLite. Nothing is sent anywhere except (optionally) to the configured reasoning engine. Still, always rotate any real secret that leaks.
Full docs, deployment script and the hackathon submission dossier live in the GitHub repository.