Benchmarks
Numbers you can reproduce.
A governance layer sits in the path of every tool call, so it has to be fast. It also has to catch what it says it catches. Here are both, measured, with the method and the limits, and the commands to run them yourself.
Latency
Authorization in milliseconds
The engine is measured in-process against PostgreSQL, so HTTP framing is excluded. Every authorization runs all seven layers: token verification, revocation, capabilities, argument constraints, rate limits and budgets, behavioral holds and the oversight matrix. Every one is audited before it returns.
Authorize p50
Authorize p95
Token check p50
Token check p95
| Operation | Samples | p50 | p95 | p99 | Release gate (CI) |
|---|---|---|---|---|---|
| Authorize a tool call (allow path, constraints and matrix evaluated, audited) | 1,000 | 10.76 ms | 13.73 ms | 16.84 ms | p95 < 20 ms |
| Verify an agent token (signature, claims, revocation) | 4,000 | 1.47 ms | 1.92 ms | 2.40 ms | p95 < 2 ms |
Measured 22 October 2026 on one laptop: an Intel Core i9-11900H (16 threads, 32 GB), with PostgreSQL 16 in Docker on the same machine and warm caches. These are internal test results, not a guarantee for your hardware. The release gates in the last column run in CI on every change, and a build that misses them fails.
Reproduce
npx tsx scripts/dev-stack.ts # Postgres, Sentinel, mock services SENTINEL_BASE=http://localhost:3000 PERF_N=1000 npx tsx test/perf/perf.ts
Detection
What the monitoring rules catch, and what they miss
Seven attack classes were scored by the rules that ship, on 2,100 synthetic attack scenarios and 2,000 benign scenarios (298,240 benign agent actions). Each class mixes clear attacks, attacks near the thresholds, and evasive variants the rules are not built to catch. The misses are evasive variants, and we show them.
| Attack class | Detection rate | 95% lower bound | False-positive rate | 95% upper bound |
|---|---|---|---|---|
| T1 Action burst with kill-chain progression | 85.3% | 81.5% | 0.00% | 0.15% |
| T2 Resource outside the manifest, with drift | 88.7% | 85.2% | 0.00% | 0.15% |
| T3 Reported outcome differs from observed state | 88.0% | 84.5% | 0.00% | 0.15% |
| T4 Audit infrastructure tampering or silence | 83.3% | 79.4% | 0.00% | 0.15% |
| T5 Credential harvesting or misuse | 76.3% | 71.9% | 0.85% | 1.27% |
| T6 Enumeration, then a target outside the workspace | 88.7% | 85.2% | 0.00% | 0.15% |
| T7 Unmanifested agents, jobs, packages or compute | 81.3% | 77.2% | 0.00% | 0.15% |
- Clear and near-threshold variants are caught at 95–100%. For example, T5 bulk reads, egress and misuse score 100% each; the 71 evasive T5 scenarios score 0%.
- Bounds are exact one-sided 95% Clopper-Pearson intervals.
- T5 false positives work out to about 6 false alerts a day at 100,000 agent actions a day. Tune the thresholds per tenant.
Internal test on synthetic scenarios (library v1, seed 20261101). Synthetic data measures the rules against the behaviors they model, not behaviors nobody modeled. Run new rules in shadow mode, which logs what they would have blocked, before you enforce them. The full report, including results per variant, is docs/eval/REPORT.md in the repository, and npx tsx scripts/eval-detections.ts regenerates it.
Correctness
Tested against a production build
Every change runs the full end-to-end suites against next build with a real PostgreSQL. They cover authorization, delegation, approvals, revocation, tenant isolation, on-behalf-of exchange, credential brokering, cost budgets, BOM attestation, policy bundles, SCIM and the MCP proxy.
- Adversarial suites replay attacks and require every one to be blocked: forged tokens (alg none, key confusion, a rewritten tenant), token reuse across audiences, revoked-token replay, delegation abuse, cross-tenant access, and injection-shaped or oversized inputs.
- Row-level security is tested on every tenant table: one tenant can never read or write another's rows.
- A static check fails the build if any authorization path returns without an audit record.
What we do not claim
No borrowed numbers
Every figure on this page comes from Sentinel's own test suites, with the date, the hardware and the method. When we publish comparisons or third-party results, they will be labeled with their source and kept separate from our own.
Ask about a benchmark