LawGuard inside Server Sentinel

One coordinated service*
Server Sentinel brings infrastructure and security evidence together, helps explain what needs attention, and proposes a response. LawGuard gives that response a precise permission boundary inside the Sentinel workflow. Sentinel remains the single action issuer. Sensors provide observations and AI helps interpret them; LawGuard checks permission at the place where an action would take effect.

Permission with a defined scope*
Permission is specific: one client, one device, one program and one supported security function, with clear action limits. A local grant records that agreed boundary. LawGuard compares each request with it, including the target and permitted lifetime. A central request cannot expand the local grant by itself. New threat rules also stay within the existing response permissions.

From a warning to a proposal*
Consider an intrusion warning. A login sensor reports suspicious activity, and Sentinel connects the finding with the affected server and its available evidence. Your team sees what is known and what needs checking. Sentinel proposes a narrow response: temporarily blocking one specified source address on that server. The proposal describes exactly what would change, so the decision is reviewable.

Approval becomes an exact permission record*
With the Managed option, an authorized operator reviews and approves that exact request. Sentinel checks the approval, current policy and stop state before issuing a signed action grant and its linked LawGuard permit. These records identify the same action and target. An AI explanation alone supplies no execution authority. Approval travels with a precise request rather than a general instruction to fix everything.

The receiving device checks again*
At the receiving device, LawGuard checks the signed records against the independently configured local grant. The program, function, client, device and action limits must match. Current stop controls and protected management paths are checked before new execution. A changed or expired request is refused. Only a request inside the agreed boundary reaches the supported response executor that performs the action.

See the result, including uncertainty*
The workflow records the attempt and returns a receipt. A separate outcome check establishes what can be confirmed afterward. Your control panel distinguishes permission, attempted action and checked result. If confirmation is unavailable, the outcome remains unknown and the same request is held for review instead of being repeated automatically. Your team keeps the evidence needed to review the situation and choose the next step.

Choose the level of control*
You choose the response model. Advisory means watch and explain, with no containment action. Managed means approve each specific supported action. Pre-authorized Protection allows only explicitly authorized operations within named targets and local limits, with stop controls still in place. LawGuard connects these choices to the receiving device, giving your team a clear path from evidence to permission, action and an accountable outcome.

* Currently in final R&D.
