Bud SENTRY
Secure Evaluation and Runtime Trust — the security, governance & compliance plane of the Bud stack: zero-trust model ingestion, CPU-native Sentinel guardrails at 0.70ms p50, 160+ policies, RBAC and identity brokering, and one immutable audit trace across the entire agent lifecycle. Built in, not bolted on.
One governance plane. Every model, every call.
A model pulled from a third-party source isn't just weights — it can carry executable scripts, obfuscated binaries, or embedded malware. SENTRY enforces a zero-trust lifecycle for every model and every call: verified at ingestion, contained in a sandbox, continuously monitored in production — with guardrails, RBAC, and immutable audit on the same plane.
Layer 06 of the Bud stack.
SENTRY governs everything above and below it — every agent action, every inference call, every model artifact crosses this plane. Models, agents, and tokens all answer to the same control plane.
Governs above — every Studio and Agent action is admitted, policy-checked, rate-limited, and logged by SENTRY; agent access to MCP tools crosses the same plane.
Guards below — Sentinel classifies the input and output edge of every inference call AI Foundry serves, and every model entering via Model Foundry passes the zero-trust supply chain.
Verify. Guard. Enforce. Audit.
Six capability groups — the model supply chain, the runtime guardrails, and the governance machinery around them, expanded to the specifics an evaluator needs.
Bud Sentinel is a component within SENTRY, not a separate platform layer — trained on 4.5M labelled samples, the largest open guardrails dataset in existence, and 2.3× faster on a laptop than competing guardrails on a $15,000 A100 GPU. Served from one binary through the Bud Guardrail Gateway. The engine has its own deep-dive: the Bud Sentinel product brief.
Architecture & components.
A zero-trust supply chain for model artifacts, an eleven-step governed request pipeline, and a layered guardrail engine built on Resource Aware Attention — wired so every request carries identity, policy, cost, and audit context automatically.
The zero-trust model supply chain — six gates
Zero-trust means the pipeline runs on every pull — a model from Hugging Face gets the same treatment as one from an internal registry.
The governed request pipeline — eleven steps, one trace
When an employee interacts with an agent in production, the request flows through the whole platform in a single governed pipeline. SENTRY and Sentinel own four of the eleven steps — admission, input guarding, output guarding, and the closing audit record.
| Step | Component | What happens |
|---|---|---|
| 01 | Bud Studio | Authenticates the user; packages the request. |
| 02 | Bud SENTRYthis layer | Validates RBAC; checks 160+ policies; logs for audit; applies rate limits and FinOps. |
| 03 | Bud Sentinel · inputthis layer | Classifies for safety, toxicity, PII, compliance in 0.70ms on CPU. Blocks violations pre-inference. |
| 04 | AI Gateway | Routes by complexity, cost, SLO — local SLM or frontier model; prompt caching cuts cost 23–40%. |
| 05 | Bud Agent | Executes the workflow; decomposes tasks; manages state and memory; coordinates other agents. |
| 06 | Bud MCP Foundry | Governed, auditable connections to CRM, ERP, databases, APIs. Every access logged and policy-checked. |
| 07 | Bud Runtime + LayerZero | Serves inference; abstracts hardware; self-healing. |
| 08 | Bud Sentinel · outputthis layer | Classifies the response for safety, PII, toxicity, compliance before it reaches the user. |
| 09 | Bud Scaler | SLO-aware compute allocation; FinOps attributes cost per department, use case, agent. |
| 10 | Bud SENTRY · auditthis layer | Logs the complete lifecycle in a single unified trace — every step attributable. |
| 11 | ART · background | Captures the interaction as a training signal; feeds continuous SLM improvement. |
Resource Aware Attention — the mechanism behind Sentinel
Existing guard models take a GPU-designed transformer and compress it until it fits on a CPU — landing at 334–3,855ms per classification, capped at 512 tokens. RAA is designed from the deployment envelope inward, and three principles govern it.
The target cache hierarchy, precision tier, and latency SLO are declared before training — the mechanism is shaped by its resources, not retrofitted to them through post-hoc compression.
No quadratic phase change with sequence length: long inputs mean more of the same cheap work. That is why 65,536-token classification is native rather than a chunk-and-vote retrofit.
A single attention pass supports many task heads in parallel — safety, PII spans, intent, routing. A chain of five classifiers becomes one shared attention cost with cheap decisions on top.
The RAA layer is one of several. The fast layer handles the firehose at single-digit-millisecond latency; behind it sit deeper scans — higher-capacity review for tail risk, specialised detectors for adversarial patterns, and escalation paths for ambiguous cases. The speed of the fast layer is what makes the deeper layers affordable at production volume.
Guardrails everywhere — including the edge.
CPU-native means no GPU dependency and no egress — the same enforcement plane runs in the cloud, on-prem, air-gapped, on a laptop, and out at the edge.
| Requirement | Detail |
|---|---|
| Compute | CPU-only — no GPU dependency, no egress. Enforcement runs on the same fleet the application already runs on, at the latency budget it already has. |
| Server envelope | Intel Xeon 6972P — 4,400+ req/s at 512 tokens, p99 under 12ms at 50-way concurrency. |
| Long-sequence envelope | Intel Xeon Platinum 8272CL — 65,536-token inputs at 560ms p50; transformer baselines cap at 512 tokens. |
| Laptop / on-device | Intel Core Ultra 7 268V (fanless) — ~1,500 req/s at 128 tokens: guardrails inside a desktop app, browser extension, IDE, or embedded agent, with no server call at all. |
| Edge | ~25ms on edge CPUs — 96× faster than competing guardrails on the same hardware. |
| Identity | Okta, Entra ID, Google Workspace — OIDC, OAuth 2.0, SAML 2.0. |
| Compliance | SOC 2, GDPR, and EU AI Act-aligned controls with exportable reports; certified vs. in-progress posture documented on the Trust hub. |
Deployment modes
The full supply-chain pipeline and Sentinel guardrails run in every mode — air-gapped deployments give up nothing, because nothing depends on a GPU or an external call. The same 160+ policies are enforced identically in every tier, so moving from cloud to VPC to air-gapped means zero re-integration.
Identity & SSO
Identity brokering with the IdP you already run, on day one — RBAC scopes flow from it across modules, projects, and APIs.
Threat & content coverage
23 specialised models across 33 variants cover the input and output edges of every LLM call — plus model supply-chain threats before anything runs.
Every headline number, with its basis.
Accuracy is reported on four public benchmark suites; competitors were measured via their published runtime pipelines on the bare machine, while Sentinel was measured end-to-end over its serving interface — its numbers include the network and RPC path a real request traverses.
| Claim | Metric | Baseline / boundary | Conditions |
|---|---|---|---|
| 0.70ms p50 | classification latency | 10K concurrent connections | CPU-native serving |
| 5.67ms per request | end-to-end latency | vs. 3,777–3,855ms baselines | EPYC 7V13 · 512 tok · incl. RPC |
| 8.39ms on a laptop | end-to-end latency | vs. 18–19ms baselines on A100 | i7-11370H · 512 tok |
| ASR & FRR <20% | 15.97% / 14.92% | Aggregate of 4 public suites | only evaluated model under both |
| 4,400+ req/s | sustained throughput | Single Xeon 6972P node | 512 tok · conc 50 · p99 <12ms |
| 65,536-token input | native classification | Baselines capped at 512 tok | Xeon 8272CL · 560ms p50 |
| ~$0.10 per 1M | classification cost | vs. ~$24 on GPU | 239× cheaper |
| 84.56% balanced accuracy | accuracy | #1 across 4 benchmarks | same suites as ASR/FRR |
| 15–18× cost-performance | $0.50/hr CPU | vs. $2–3/hr GPU guardrail | single node · Intel Xeon · sustained load |
| 124M per day | classifications | production platform scale | every agent action guardrailed · CPU pricing |
“By optimizing Sentinel for Intel® Xeon® processors, Bud enables enterprises to scale AI safety with high performance and significantly lower total cost of ownership, without the cost and complexity of GPUs.”Sangeeta Roy — Director, Global Partner Business Leadership, Intel
The only deployable operating point.
The comparables are transformer guard models — Prompt Guard 2, Prompt-Guard-86M, ArchGuard, PIGuard, ProtectAI V2 — plus the 3–5 separate governance tools around them. The category forces a choice SENTRY doesn't.
Where the category stands
- Transformer guards land at 334–3,855ms per classification on the server CPUs operators actually run
- Input capped at 512 tokens — long context means chunking, voting, and re-aggregation pipelines
- The low-ASR models get there by refusing 82–89% of benign traffic — unshippable operating points
- Acceptable latency only with a dedicated GPU in front of every classifier
- Guardrails, compliance, PII, audit, and access control split across 3–5 tools with no shared data model
Where only Bud SENTRY lands
- Only evaluated model with ASR and FRR both under 20%
- Single-digit ms on commodity CPUs — faster than the baselines on an A100
- 65,536-token inputs natively, no chunking retrofit
- Zero-trust model supply chain before anything runs
- Guardrails, RBAC, policies, monitoring, and audit on one plane
- One unified trace across the full agent lifecycle
- No GPU, no egress — air-gapped and edge-deployable
- Trained on 4.5M labelled samples — the largest open guardrails dataset
Where the plane earns its keep.
Six situations where governance being native — rather than bolted on across five tools — changes what an organisation can ship.
Third-party models, safely
A model pulled from a public hub gets sandboxed, scanned across formats, and checked for exploits and trojaned weights before it ever runs — and its verified state is monitored in production.
EU AI Act traceability, one trace
The Act requires traceability across the full pipeline. When that pipeline is one platform with one immutable trace, the audit is an export — not weeks of correlating twelve systems.
HR & customer data with no gaps
PII detection and redaction across 11 regions run natively on every call, input and output — no gap between the guardrail tool and the logging tool for records to slip through.
MNPI-safe multi-agent work
Multi-agent financial analysis where every action is policy-checked and logged — memory leakage between agents becomes a controlled, auditable surface instead of an open risk.
Air-gapped, no GPU, no egress
The full enforcement plane runs CPU-native with zero call-home — sovereign deployments go live in weeks on infrastructure that never touches an external API.
Guardrails inside the app
~1,500 req/s on a fanless laptop CPU means guardrails ship inside a desktop app, browser extension, IDE, or embedded agent — with no server round-trip at all.
The full benchmarks, in depth.
This brief is the reference. For the complete benchmark tables, the Resource Aware Attention argument, and the per-suite accuracy numbers, read the whitepaper.
Technical whitepaper
Bud Sentinel Whitepaper
A CPU-native safety guardrail for LLMs
The full benchmark tables — attack success and false-refusal rates vs. PIGuard, Prompt Guard 2, ProtectAI V2, and ArchGuard — plus the Resource Aware Attention architecture behind single-digit milliseconds on Xeons.
Read the whitepaperBack to overview
Bud SENTRY
Security, governance & compliance
Return to the high-level product page — the headline numbers and the overview of the governance plane.
Back to the product pagePut your data on it.
The fastest way to see what an integrated AI operating system does for your enterprise is a proof-of-concept on your infrastructure, with your data.