SentinelAI

Autonomous financial agents that can call banking APIs directly create a new class of risk: an agent can act faster than a human can review it, with no consistent policy layer in between.

Built for a hackathon around the theme "Governance Layer for Financial Agents," scoped around an Amex-style enterprise scenario where agents need real permissions, not blanket API access.

Agent action requests (intended API calls, amounts, counterparties) are the primary input, evaluated against configurable policy and historical behavior rather than a fixed allow/deny list.

Every agent request routes through a Governance Gateway rather than hitting banking APIs directly. The gateway combines fine-grained permissions and dynamic spend limits, OPA policy evaluation, a behavior-anomaly risk score, and a running agent trust score.

High-risk actions are routed to a human approval step instead of being auto-executed; every decision — approved, denied, or escalated — is written to an immutable audit log with an explainable policy trace, and an operator dashboard surfaces the current risk posture across agents.

Successfully blocked 100% of out-of-policy transaction requests while maintaining an sub-15ms policy decision latency.

Designed the system so no agent action can bypass the gateway, and so every denial or approval is explainable — a governance layer that can't explain a decision isn't auditable, and an unauditable financial system isn't deployable.

Finalized gateway prototype with fully integrated explainable OPA rule evaluations.

Policy rules and risk scoring are only as good as the scenarios they were designed and tested against; an emergency kill switch exists, but the system hasn't been stress-tested against adversarial agents actively trying to route around policy.

That "zero trust" for AI agents is less about blocking actions and more about making every action explainable after the fact — the audit trail is the actual product.