{
  "markdown": "# Sentinel Stack\n\n**Open-source AI governance for every LLM.**\n\n12 specialized skills that embed DLP, EU AI Act compliance, and real-time audit evidence into your AI workflows — so compliance happens automatically, not after the fact.\n\nWorks with **Claude, GPT-4, Gemini, Copilot, Cursor**, and any model that reads markdown.\n\n> *\"Compliance isn't something you do separately. It's a byproduct of doing your work through guardrails.\"*\n\n---\n\n### 🛡️ Part of the Sentinel Stack family\n\nThis repo is the **skills layer**. Companion tools (each its own repo):\n\n| Tool | What it does | Status |\n| --- | --- | --- |\n| [**Warden**](https://github.com/aadityaparab/sentinel-warden) · `sentinel-warden` | Firewall that scans agent skills, MCP servers & rules files for prompt injection, exfiltration & tool poisoning **before you install**. | ✅ Live |\n| [**Act**](https://github.com/aadityaparab/sentinel-act) · `sentinel-act` | EU AI Act readiness pack — risk-tier classifier + conformity docs. | ✅ Live |\n| **MCP Gateway** · `sentinel-mcp` | Runtime policy + DLP + audit on live MCP tool calls. | 🗺️ Planned |\n| **Skills** · this repo | 12 markdown governance skills for Claude, GPT, Gemini, Copilot, Cursor. | ✅ You're here |\n\n---\n\n## The Problem\n\nEvery company using AI is sitting on a ticking compliance clock.\n\n- The **EU AI Act** is enforceable. High-risk AI systems need risk classification, human oversight documentation, and transparency disclosures.\n- **SOC 2 auditors** are asking about AI controls for the first time — and most companies don't have answers.\n- **CISOs** want to know what data is flowing into which models. GRC analysts are drowning in spreadsheets documenting it all after the fact.\n- **Nobody wants to slow down.** Teams are shipping with AI and compliance is chasing them with a clipboard.\n\n## The Approach\n\nSentinel Stack takes a fundamentally different approach: **governance is embedded in the workflow, not bolted on after.**\n\nEvery AI interaction passes through a DLP engine and compliance guardrails. Every blocked request automatically becomes audit evidence that your controls work. Every 4-eyes review gate becomes segregation-of-duties proof. Every scan — even the clean ones — becomes evidence that your monitoring is active.\n\nYou don't \"do GRC\" separately. It happens because your AI workflows run through Sentinel Stack.\n\n---\n\n## The 12 Skills\n\n### Always-On Protection\n| Skill | What it does |\n|-------|-------------|\n| **guardrails** | Scans every prompt and file for sensitive data before processing. Hard blocks on client data and financial identifiers. Soft blocks with clarification for ambiguous cases. Enforces GDPR/privacy handling. Appends 4-eyes review gates to high-stakes outputs. Emits compliance signals on every decision. |\n| **dlp-engine** | 3-tier sensitivity scoring engine. Tier 1: regex pattern matching (SSNs, API keys, credentials). Tier 2: industry classifiers (private markets, healthcare, fintech, legal). Tier 3: behavioral baselines (anomalous request size, off-hours, new provider). Produces a 0-100 score → allow / log / alert / redact / block. |\n\n### AI Governance\n| Skill | What it does |\n|-------|-------------|\n| **ai-governance** | Classifies AI use cases by EU AI Act risk tier (Unacceptable / High / Limited / Minimal). Enforces your AI acceptable use policy. Determines transparency obligations — when must users know they're interacting with AI? Specifies meaningful human oversight requirements for high-risk systems. Tags AI-generated content with data lineage metadata. |\n| **vendor-ai-risk** | Evaluates third-party AI tools across 5 dimensions: security, privacy, AI-specific risks (bias, hallucination, transparency), contractual requirements (DPA, liability, SLAs), and regulatory compliance. Quick triage mode (5 min) and deep assessment mode (full due diligence). Produces a scored risk card with go/no-go recommendation. |\n\n### Compliance Automation\n| Skill | What it does |\n|-------|-------------|\n| **compliance-evidence** | Auto-generates framework-mapped evidence from normal guardrail operations. Every DLP block → Data Classification control evidence. Every 4-eyes gate → Segregation of Duties proof. Maps to SOC 2 Type II, ISO 27001, NIST CSF, and GDPR Article 30. Generates evidence packages on demand for auditors. |\n| **risk-register** | Living risk register that auto-populates from guardrail detections. Every hard block, soft block, and behavioral anomaly becomes a risk entry. 5×5 likelihood-impact scoring. Categorizes across Data Privacy, AI Ethics, Regulatory, Operational, Reputational, Financial. Tracks treatment (accept/mitigate/transfer/avoid) with owner assignment. Trend analysis and board-ready reports. |\n| **audit-trail** | Structured JSON-lines logs from every guardrail decision, DLP scan, 4-eyes review, and AI-assisted output. Ready for SIEM ingestion (Splunk, ELK, Datadog). Retention guidance by regulation (GDPR, SOC 2, HIPAA). Generates audit reports by time period, framework, or event type. |\n| **policy-drafter** | Drafts organizational AI policies: Acceptable Use, Data Handling, Third-Party AI Vendor, and Incident Response. Pre-fills with sensible defaults based on your industry and jurisdiction. Flags sections that must be customized. Includes version control, review cadence, and approval workflow. |\n\n### Decision Support\n| Skill | What it does |\n|-------|-------------|\n| **decision-audit** | Audits governance decisions for data quality, logical consistency, and strategic alignment. Validates that risk assessments are evidence-based. Flags assumptions and gaps. Useful for documenting why AI governance decisions were made the way they were. |\n| **first-principles** | Structured problem decomposition from fundamental assumptions. Useful for policy design, risk modeling, and evaluating whether existing controls address the actual risk or just the perceived one. |\n\n### Setup & Efficiency\n\n| Skill | What it does |\n|-------|-------------|\n| **setup** | Re-runnable 6-question wizard (`/sentinel-stack:setup`) that tailors every other skill to your organisation: company and domain, industry, jurisdiction, compliance frameworks, AI risk appetite, and escalation contact. Writes `config/org-config.yaml`, updating only the fields it owns and leaving the rest untouched. |\n| **caveman** | Always-on token-efficient mode. Compresses conversational prose ~65–75% (status updates, explanations, tool preambles) while keeping policies, risk register entries, audit logs, compliance evidence, DLP classifications, AI risk tiers, code, and regulation citations at full audit-grade fidelity. Adapted from [JuliusBrussee/caveman](https://github.com/JuliusBrussee/caveman) (MIT). Disable per-session with \"verbose\" or \"normal mode\". |\n\n---\n\n## Works With Every Major AI Platform\n\n| Platform | How | Guide |\n|----------|-----|-------|\n| **Claude Code** | `claude --with sentinel-stack/CLAUDE.md` | Native — full skill routing |\n| **Claude Desktop** | Add skills to `.claude/skills/` | Native skill support |\n| **GitHub Copilot** | `.github/copilot-instructions.md` | [platforms/copilot/](platforms/copilot/) |\n| **OpenAI / ChatGPT** | Custom GPT or Projects | [platforms/openai/](platforms/openai/) |\n| **Google Gemini** | Gems or Vertex AI | [platforms/gemini/](platforms/gemini/) |\n| **Cursor / Windsurf** | Rules files or context | [platforms/cursor/](platforms/cursor/) |\n| **Any LLM** | `INSTRUCTIONS.md` as system prompt | Universal |\n\nThe skills are plain markdown. Any model that can read context can follow them.\n\n---\n\n## Quick Start\n\n```bash\ngit clone https://github.com/aadityaparab/sentinel-stack.git\ncd sentinel-stack\nbash scripts/setup.sh\n```\n\n### Claude Code\n```bash\nclaude --with sentinel-stack/CLAUDE.md\n```\n\n### GitHub Copilot\n```bash\ncp platforms/copilot/.github/copilot-instructions.md your-repo/.github/\n```\n\n### OpenAI Custom GPT\nUpload `INSTRUCTIONS.md` + skill files as knowledge — see [platforms/openai/](platforms/openai/)\n\n### Any LLM\nLoad `INSTRUCTIONS.md` as your system prompt. Load individual skill files as context when needed.\n\n---\n\n## How It Works\n\n```\nUser Request\n    │\n    ▼\n┌──────────────────────────────────────────┐\n│  Guardrails (always-on)                  │\n│  ├── Scan prompt + attached files        │\n│  ├── DLP engine scores sensitivity       │\n│  └── Emit compliance signal ─────────────┼──→ Risk Register (auto-entry)\n│                                          │──→ Compliance Evidence (auto-mapped)\n│                                          │──→ Audit Trail (auto-logged)\n└──────────────────────────────────────────┘\n    │\n    ├── HARD BLOCK → stop, log incident, explain how to re-submit\n    ├── SOFT BLOCK → ask specific clarifying question, log\n    └── CLEAN → proceed\n         │\n         ▼\n    AI produces output\n         │\n         ├── High-stakes? → 4-Eyes review gate appended\n         ├── AI-generated? → Data lineage tag + transparency check\n         └── Compliance signal emitted (even for clean passes)\n```\n\nEvery interaction — blocked or clean — generates compliance evidence. No extra steps.\n\n---\n\n## Configuration\n\n```bash\ncp config/org-config.example.yaml config/org-config.yaml\n```\n\n| Section | What it controls |\n|---------|-----------------|\n| `company.*` | Name, industry, jurisdiction |\n| `dlp.*` | Sensitivity thresholds, industry pack (private-markets / healthcare / fintech / legal / saas), custom regex patterns |\n| `guardrails.*` | Active policies, 4-eyes approver roles, escalation contacts |\n| `ai_governance.*` | Risk appetite, prohibited AI use cases, transparency policy, oversight requirements |\n\nSee [docs/CUSTOMIZATION.md](docs/CUSTOMIZATION.md) for detailed guidance per industry.\n\n---\n\n## Architecture\n\n```\nsentinel-stack/\n├── INSTRUCTIONS.md              # Universal — works with any LLM\n├── CLAUDE.md                    # Claude-specific orchestrator\n├── platforms/\n│   ├── copilot/                 # GitHub Copilot\n│   ├── openai/                  # ChatGPT / GPT API\n│   ├── gemini/                  # Google Gemini / Vertex AI\n│   └── cursor/                  # Cursor, Windsurf, Zed\n├── config/\n│   └── org-config.example.yaml  # Your org's settings\n├── skills/\n│   ├── guardrails/              # Always-on DLP + compliance scanning\n│   │   ├── SKILL.md\n│   │   └── references/\n│   │       ├── data-classification.md\n│   │       └── review-gates.md\n│   ├── dlp-engine/              # 3-tier sensitivity scoring\n│   │   ├── SKILL.md\n│   │   └── dlp-engine.ts        # TypeScript reference implementation\n│   ├── ai-governance/           # EU AI Act + AI usage policy\n│   │   ├── SKILL.md\n│   │   └── references/\n│   │       └── ai-risk-tiers.md\n│   ├── risk-register/           # Auto-populated risk register\n│   ├── compliance-evidence/     # SOC 2 / ISO 27001 / NIST / GDPR\n│   ├── audit-trail/             # Structured compliance logs\n│   ├── policy-drafter/          # AI policy templates\n│   ├── vendor-ai-risk/          # Third-party AI assessment\n│   ├── decision-audit/          # Governance decision validation\n│   ├── first-principles/        # Problem decomposition\n│   ├── setup/                   # 6-question org configuration wizard\n│   └── caveman/                 # Token-efficient output, audit-grade carve-outs\n├── scripts/\n│   └── setup.sh\n└── docs/\n    ├── ARCHITECTURE.md\n    ├── CUSTOMIZATION.md\n    └── SKILL-HIERARCHY.md\n```\n\n---\n\n## Who This Is For\n\n- **Founders & CTOs** shipping AI features who need governance that doesn't slow them down\n- **GRC analysts** tired of documenting AI controls in spreadsheets after the fact\n- **CISOs & security teams** who need an AI governance framework yesterday\n- **Compliance officers** preparing for SOC 2, ISO 27001, or EU AI Act audits\n- **Anyone evaluating AI vendors** who wants a structured risk assessment\n\n---\n\n## Contributing\n\nPRs welcome. Each skill is a self-contained directory:\n\n```\nskill-name/\n├── SKILL.md           # Required — instructions + workflow\n└── references/        # Optional — loaded on demand\n```\n\nKeep `SKILL.md` under 500 lines. Use `references/` for large lookup tables or policy documents.\n\n## License\n\nMIT\n",
  "bytes": 12120,
  "sha": "0b883022126140866e052b33b74b82a70434a2a4bd620621191e54aaea3e30c6",
  "repo_slug": "aadityaparab/sentinel-stack",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_aadityaparab_sentinel_stack_sentinal_sta_a0a1126b/readme"
}