Either the agent is sandboxed until it is useless, or somebody hands it a production credential and hopes. So it reads staging data and answers wrong, or a human approves every action and you have automated nothing.
Sentinel lets your agent use a credential it is never given. Your cloud provider cannot see it. Neither can we.
For teams building agents that touch production systems. No newsletter.
900
challenges run against
nine miners
100%
of dishonest miners
detected
0
honest miners
wrongly rejected
Verify, don't trust
Run these yourself.
Bittensor testnet, netuid 554. Validator and miner registered, weights landing on chain.
btcli subnets metagraph 554 --network test
The numbers above. The write-up also records where the scoring is still too lenient.
python scripts/benchmark.py --rounds 100
The same report shown above, verified against AMD's certificate chain, offline. Runs in CI on every commit.
python -m pytest tests/test_sevsnp.py -q
How it works
01
It holds your credential and it is yours. If we held it, you would be trusting us again.
02
A hash. The credential is released only to an enclave that proves it booted exactly that.
03
Inside encrypted memory on an AMD SEV-SNP processor. Neither the host nor anyone with physical access to the machine can read it.
04
Every response carries a signature from the chip, bound to your request, checkable against AMD's root.
Where this is honest
The launch measurement covers the image that booted, not the application running on top of it. An operator with root in their own VM can change the code after boot and still produce a valid attestation. We tested this on our own live miner and it scored full marks while serving fabricated data. Binding the filesystem into the measurement is in progress; until it lands, the guarantee holds against the host and the infrastructure, not against the operator. Rotating an approved image is also unsolved: when a cloud provider refreshes its guest image the measurement changes and every miner fails at once. And Sentinel proves which code ran, not that the code is good. An approved image with a bad prompt can still do something stupid with legitimate access. All of this is in the repository, including the trust anchor bug we found in our own verifier and fixed.