bud-sentry – BudEcosystem

What is Bud Sentry

Responsible AI, enforced by default.

Bud Sentry is the security and compliance layer of the Bud ecosystem — and it is deliberately cross-cutting. The policies and settings you define here apply to every other layer: model training, ingestion, inference, and the agent layer above them.

Responsible AI deployment comes down to two questions: is it secure, and can you prove it was compliant. Sentry is built to answer both — at runtime, on every request, with an evidence trail behind each decision.

01

One policy layer, every AI layer

Set a rule once and it holds wherever AI touches your business — the model being ingested, the request being served, the agent calling a tool. No per-layer reimplementation, no gaps between them.

Cross-cutting by design

02

Security and compliance, together

Most stacks treat them separately — scanners on one side, policy documents on the other. Sentry unifies both under one layer, because an unsafe model and an unlawful decision are the same class of deployment risk.

Secure & compliant

03

Enforcement at the moment of risk

Controls act where the risk actually occurs — on the input, on the output, and at the tool boundary — blocking, redacting, or routing to a human before an action is taken, not after.

Runtime, not paperwork

04

Evidence, not assertion

Every decision is recorded as an audit span. That's the difference between claiming you have controls and showing an auditor each decision and why it was made.

Provable

Why now

Governance stopped being a document.

Agentic AI moves enterprises from systems that answer to systems that act — calling tools, writing records, making consequential decisions. That shift turns governance into a runtime control problem, exactly as regulators are making it mandatory.

Regulation is enforceable now

EU AI Act bans on prohibited practices already apply, and high-risk duties — risk management, logging, human oversight — phase in across 2026–2027. Deploying without controls is a measurable liability.

Agents widen the risk surface

Unlike chatbots, agents call tools, write data, and make decisions. Prompt injection and goal hijack become operational threats — an over-trusted agent can leak data or fire an unsafe action on its own.

“Trust us” no longer passes audit

Regulators, SOC 2 and ISO auditors, and enterprise procurement now demand evidence of controls. A decision-level audit trail is what separates asserting compliance from proving it.

Data leakage is the top risk

PII, PHI, and secrets routinely escape through prompts and responses, each exposure carrying regulatory penalties and breach-notification cost. Redaction at the boundary is table stakes.

One footprint, many regimes

A multinational must satisfy the EU, a patchwork of US state rules, and APAC laws at once — a target that keeps moving. Adaptable runtime controls beat point solutions hardcoded to one law.

The question has changed

It is no longer whether to govern AI, but whether you can prove you did — to an auditor, to a regulator, and to the customer whose data or decision was involved.

What's inside Sentry

Three pillars. One layer.

Each pillar guards a different point in the lifecycle — what enters your environment, what flows through it, and what your agents do with it.

Pillar 01

Model supply chain

Secures what enters.

A zero-trust ingestion lifecycle. Every model is verified, contained, and continuously monitored before it is allowed anywhere near production.

Layer — Model ingestion

Pillar 02

Bud Sentinel

Secures what flows.

Runtime guardrails on every request — 23 specialised models across security, safety, toxicity, compliance, and quality. Runs on commodity CPUs.

Layer — Inference & runtime Explore Bud Sentinel

Pillar 03

AgentMesh Governance

Proves it was compliant.

Runtime governance for agentic systems — eight regulation-mapped policy packs that block, redact, and route at the moment of risk, recording every decision.

Layer — Agents & tool calls

Pillar 01 — Model supply chain

A model is executable code.

Pull a model from Hugging Face or any third-party source and you're not just downloading weights — you could be importing executable scripts, obfuscated binaries, or embedded malware. Sentry treats every model as untrusted until proven otherwise.

Pickle serialization exploits

Malicious PyTorch models have been found embedding reverse-shell backdoors that trigger on load, enabling full system compromise.

Trojaned weights

Parameters subtly modified to exhibit backdoor behaviour — responding to secret inputs or leaking information during inference. Hard to detect in large models.

Tainted metadata & loaders

Even “safe” formats aren't immune — tainted metadata can inject misleading info, and loader-library vulnerabilities can be exploited for code execution.

Deserialization bugs

Specially formatted files that trigger arbitrary code execution or sandbox escapes through vulnerabilities in model-loading libraries.

Hidden network calls

Embedded scripts that open outbound connections to attacker-controlled servers, enabling remote access and data exfiltration from inside your infrastructure.

Binary payloads

Compiled executables and obfuscated binaries packaged alongside weights that bypass traditional scanners and execute during setup.

Every download triggers the same pipeline

Model source

Hugging Face, GitHub, internal repos — never trusted by default

→

Bud Sentry

Source verification and provenance tracking

→

Secure sandbox

Isolated download & execution — no network, no shared memory

→

Object storage → deploy

Only verified artefacts reach deployment infrastructure

Active monitoringCluster monitoringSystem monitoringTraffic monitoring

.safetensors.pt / .pth.pickle / .pkl.h5 ONNXGGUF / GGMLTensorFlow SavedModelHDF5

One-click in Bud Runtime No security expertise needed Automated security workflows

Pillar 02 — Bud Sentinel

Guardrails on every request.

Sentinel is the enforcement engine on the inference path — 23 specialised models across 33 variants, inspecting input and output. Built on Resource Aware Attention, it runs on the commodity CPUs you already have.

3

Security

Jailbreak detection, prompt-injection defence, secrets & credential exposure

models

4

Safety

Content moderation, harmful content, suicide & self-harm, drug enablement

models

8

Toxicity

Hate speech, abuse, profanity, insults, threats, identity attacks, toxic patterns

models

6

Compliance

PII detection across 11 regions, illegal activity, political content, regulated advice, bias

models

2

Quality

Spam detection, domain-specific QA validation

models

Balanced accuracy Higher is better

Bud Sentinel 84.56%

Prompt Guard 2 75.01%

PIGuard 74.57%

ProtectAI V2 69.63%

ArchGuard 56.48%

Prompt Guard 52.41%

Every other system trades one failure mode for the other — blocking attacks but refusing legitimate users, or keeping refusals low while letting attacks through. Sentinel leads on both: a 15.97% attack success rate at a 14.92% false refusal rate. Benchmarked across JailBreakBench, PIGuard, WildJailbreak and Qualifire PI.

23 models · 33 variants One API via the Bud Guardrail Gateway CPU-native — zero GPU cost

Explore Bud Sentinel

Pillar 03 — AgentMesh Governance

Governance that runs.

AgentMesh wraps live AI agents with eight pre-built governance policies that inspect every input, output, and tool call — then deny, redact, or route to a human, recording each decision as an OpenTelemetry audit span.

8

Regulation-mapped policy packs

15

Enforcement rules

11

PII jurisdictions

7

EU AI Act articles mapped

3 verdicts 3 enforcement points 2 conflict strategies SHADOW record-only rollout

The enforcement model

Three points. Three verdicts.

Controls sit exactly where the risk is. Every input, every output, and every tool call passes the policy engine before anything irreversible happens.

Enforcement points

Input

Jailbreak and goal-hijack blocked before the agent reasons

Output

PII, PHI, and secrets redacted before the response leaves

Tool call

The boundary where an agent acts — checked before it fires

Policy
engine

Verdicts

Deny

Illegal or prohibited — the request stops here

Redact

Sensitive data removed — the work still gets done

Route to a human

Consequential decisions get a human gate

SHADOW mode — watch before you enforce

Roll a policy out in record-only mode first. Every decision is logged as if enforcement were live, so you can measure the impact against real traffic before a single request is ever blocked.

The eight packs

Pre-built, and mapped to the article.

Not a blank policy engine you have to author from scratch. Eight packs ship ready, each traced to the regulation it satisfies.

Safety & harm

Content Safety
Child Safety
Prohibited AI Practices

Blocks illegal content; routes toxicity, violence, and self-harm to review.

Data protection

Sensitive Data

Redacts PII/PHI and secrets/credentials in both request and response.

Security

Prompt-Injection Defense

Blocks jailbreak and agent goal-hijack on input, before the agent acts.

Oversight

Fairness
Regulated Advice
AI-Use Transparency

Bias monitoring, a human gate on consequential decisions, and synthetic-media controls.

Cross-cutting: Sensitive Data Cross-cutting: Prompt-Injection Defense Cross-cutting: Transparency

The audit trail

Show an auditor every decision.

Each verdict is recorded as an OpenTelemetry span — what was inspected, what was decided, and which rule decided it. Compliance stops being a claim and becomes a query.

Decision log — OpenTelemetry spans

Support agent → response

Sensitive Data · customer record redacted before send

Redacted

Unknown user → input

Prompt-Injection Defense · goal-hijack attempt blocked

Denied

Advisory agent → tool call

Regulated Advice · escalated to a human reviewer

Routed

Internal agent → response

All packs evaluated · no rule triggered

Allowed

The difference between “we have guardrails” and “we can show you every decision, and why.”

Where it applies

13+ jurisdictions. Five continents.

One deployment, many shifting regimes — mapped to the frameworks your auditors actually cite.

Regulatory regimes mapped

EU AI ActGDPRCoE Framework Convention EEOCHIPAANIST AI RMFSOC 2PCI-DSS CaliforniaColoradoNew York CityTexasUtah United KingdomChina (GB45438)South Korea (AI Basic Act)Brazil (PL2338) G7OWASP

PII coverage by country

United StatesUnited KingdomAustraliaSpainFinland IndiaItalySouth KoreaPolandSingapore General / global detector

The same eleven regions Bud Sentinel's compliance models detect — the guardrail engine and the governance layer share one map.

Industries served

Mapped to the rules you're actually held to.

Financial services

Regulated-advice routing and disclaimers; payment-card (PCI-DSS) redaction.

Insurance

Bias monitoring and decision oversight aligned to NAIC model conduct.

Healthcare & life sciences

PHI redaction under HIPAA; medical-advice oversight with a human gate.

Legal services

Legal-advice routing with human review and disclaimer.

HR & hiring

Bias signal plus a human gate on consequential decisions — EEOC, NYC LL144, and state ADMT laws.

Online platforms

Text-level child-safety duties; AI-disclosure for synthetic media.

Public sector & law enforcement — Article 5 backstops on social scoring and criminal-risk profiling. The cross-cutting packs apply to any enterprise deploying agentic AI.

Part of the Bud ecosystem

Sentry runs through everything.

It isn't a product that sits beside the stack — it's the layer the rest of the stack inherits from.

Bud Model Foundry

Training & fine-tuning

Bud Runtime

Serving & inference

Bud Studio

Agents & consumption

Bud Sentry

One policy layer · inherited by every layer above

Bud Sentry

Responsible AI, enforced by default.

One policy layer, every AI layer

Security and compliance, together

Enforcement at the moment of risk

Evidence, not assertion

Governance stopped being a document.

Regulation is enforceable now

Agents widen the risk surface

“Trust us” no longer passes audit

Data leakage is the top risk

One footprint, many regimes

The question has changed

Three pillars. One layer.

Model supply chain

Bud Sentinel

AgentMesh Governance

A model is executable code.

Pickle serialization exploits

Trojaned weights

Tainted metadata & loaders

Deserialization bugs

Hidden network calls

Binary payloads

Every download triggers the same pipeline

Guardrails on every request.

Governance that runs.

Three points. Three verdicts.

Pre-built, and mapped to the article.

Show an auditor every decision.

13+ jurisdictions. Five continents.

Mapped to the rules you're actually held to.

Sentry runs through everything.

Deploy AI you can defend.

Company

Product

Resources