Sentinel
Sentinel is an agentic privacy-routing system: sensitive data never leaves your hardware, yet the cloud still gets useful work done.
Core trick
A local Gemma model masks PII spans before the cloud agent sees any text, and an audit log records what touched each side.
Description
Sentinel is an agentic privacy-routing system: sensitive data never leaves your hardware, yet the cloud still gets useful work done. A Google Managed Agent ingests a document and, before reading a single raw byte itself, delegates the un-redacted content to a Gemma model running locally on the operator's NVIDIA DGX Spark (via Ollama behind an allowlisted tunnel). The local model classifies and masks every sensitive span (PII / financial / medical); the cloud agent then reasons only over the masked output and produces a PDF report plus an audit-log.json that proves, line by line, what touched cloud vs. local. The headline guarantee — verified end-to-end — is raw_sensitive_bytes_processed_in_cloud: 0. The problem it solves: organizations want cloud-scale AI but can't legally or ethically expose raw PII to it. Sentinel makes "the cloud trusts the local model's answer without ever seeing the raw data" an enforceable, auditable boundary rather than a policy promise.
README excerpt
# Sentinel — agentic privacy routing **Sensitive data never leaves your hardware. The cloud trusts the local model's answer without ever seeing the raw data.** Sentinel is a privacy-routing system built on Google **Managed Agents**. A cloud agent ingests a document, classifies which spans are sensitive (PII / financial / medical), and routes **only the sensitive spans** — in one consolidated call — to a **Gemma model running locally** on the operator's NVIDIA DGX Spark (Ollama, exposed via an allowlisted tunnel). Non-sensitive spans are processed in the cloud sandbox. The run produces a **PDF report** and an **`audit-log.json`** that proves, line by line, what touched cloud vs. local — with `raw_sensitive_bytes_to_cloud: 0`. ## Why this is a Managed Agents showcase Built entirely on the new Managed Agents primitives: | Primitive | How Sentinel uses it | |---|---| | `AGENTS.md` | Defines the classifier-router behavior and the hard privacy rules. | | 3 × `SKILL.md` | `pii-classifier`, `gemma-router`, `pdf-generator`. | | `code_execution` | The only tool. Classification, the local POST, and reporting all run as sandboxed Python. | | **Network allowlist + header transform** | The sandbox may reach **only** the operator's local endpoint; the egress proxy injects `Authorization` so the credential never enters the sandbox. | | Environment `sources` | `AGENTS.md`, the three skills, a stdlib helper, and the input doc are mounted inline. | | File artifacts | `audit-log.json` is em