Every "autonomous agent" pitch has a slide about safety. Most of them mean a system prompt that says "be careful." That's not a guardrail, that's a suggestion, and a suggestion is exactly what an agent ignores the moment a task gets weird.
Sentinel Prime, the agent layer running on this fleet, works from a different assumption: an agent is not a strategy, it's a process, and a process needs the same controls you'd put on any other automation you don't watch every second of.
the rule that matters most: clamp by default
Money and outbound network traffic are clamped by default, not opt-in. An agent that wants to spend, install, or reach out to the internet has to cross a line that was drawn before the task started, not one it can talk itself past mid-run. The default is closed. Opening it is a decision I make, not one the agent argues its way into.
This sounds obvious until you've watched an agent rationalize its way toward a boundary. Give a capable model a goal and a long enough context window, and it will eventually propose the thing you didn't want, phrased as the reasonable next step. A clamp that lives outside the model's own reasoning doesn't care how good the argument is.
recall before action, every time
Sentinel Prime's loop is three steps, always in this order: recall, act, remember.
- Recall — before a single action runs, the agent pulls relevant memory from Neuralis: what's been tried, what broke last time, what's already known about this system. An agent that starts cold repeats every mistake it already fixed once, forever.
- Act — the agent plans and executes locally, inside the clamp. No step skips the boundary because the plan looked confident.
- Remember — outcomes, fixes and facts get written back to the brain. The next run starts one step ahead instead of relearning the same lesson.
The loop is the guardrail as much as the clamp is. An agent that can't remember why something failed will try it again with more confidence next time. That's not autonomy, it's amnesia with extra steps.
the watchtower doesn't run anything
The fleet has a separate small box whose only job is to watch everything else and heal or alert when something goes wrong — nuke-standby. It never runs a model, never executes a task, never gets touched by an agent. It just watches.
That separation is the point. A watcher that shares infrastructure with the thing it's watching goes dark at exactly the moment you need it. If the host that runs the agents crashes, hangs, or gets compromised, the box watching for that has to still be standing afterward. So it lives on its own hardware, does one job, and stays boring on purpose.
// the pattern, if you're building this yourself Put the safety boundary somewhere the thing being bounded can't reach: clamp outside the model's control, recall outside the current run's memory, and monitoring outside the box being monitored. Three different failure domains, so one bad run can't take out the mechanism that would have caught it.
what this doesn't solve
None of this makes an agent smarter. A clamp doesn't stop bad output, only bad reach. A memory that recalls context doesn't stop a model from misreading it. A watchtower catches "the service died," not "the service did the wrong thing quietly." Guardrails narrow the blast radius; they don't replace reviewing what the agent actually did.
That's the honest tradeoff, and it's the right one. An agent with clamped money and network access, a memory that keeps it from repeating mistakes, and a watcher with no stake in the outcome can fail safely. An agent without those things can fail expensively, and you find out after.
where this runs
Sentinel Prime, Neuralis and nuke-standby are the three systems described on the homepage and broken down piece by piece on the rig page. The open-source pieces of the agent stack are on GitHub, linked from the homepage's open-source section.
Where this instinct comes from is its own story: twenty years in security operations, applied to a domain that didn't have those habits yet.