{"id":51703710,"url":"https://github.com/zafrem/bastion-sentinel","last_synced_at":"2026-07-16T13:34:01.219Z","repository":{"id":361404048,"uuid":"1241112748","full_name":"zafrem/bastion-sentinel","owner":"zafrem","description":"Bastion-RAG guardrail service: prompt-injection detection, metadata validation, and LLM output validation (hallucination, PII-leak, permission, industry filters). REST + gRPC.","archived":false,"fork":false,"pushed_at":"2026-06-07T09:54:35.000Z","size":355,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-07T11:22:35.397Z","etag":null,"topics":["ai-safety","content-moderation","golang","grpc","guardrails","hallucination-detection","llm-security","output-validation","pii","prompt-injection","prompt-injection-detection","rag","rest-api"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zafrem.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-17T01:12:20.000Z","updated_at":"2026-06-07T10:11:00.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/zafrem/bastion-sentinel","commit_stats":null,"previous_names":["zafrem/bastion-sentinel"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/zafrem/bastion-sentinel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zafrem%2Fbastion-sentinel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zafrem%2Fbastion-sentinel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zafrem%2Fbastion-sentinel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zafrem%2Fbastion-sentinel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zafrem","download_url":"https://codeload.github.com/zafrem/bastion-sentinel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zafrem%2Fbastion-sentinel/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35546266,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-16T02:00:06.687Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-safety","content-moderation","golang","grpc","guardrails","hallucination-detection","llm-security","output-validation","pii","prompt-injection","prompt-injection-detection","rag","rest-api"],"created_at":"2026-07-16T13:34:00.316Z","updated_at":"2026-07-16T13:34:01.212Z","avatar_url":"https://github.com/zafrem.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bastion-Sentinel (Module A)\n\n## Overview\n**Bastion-Sentinel** is the bidirectional security gateway of the Bastion-RAG framework. It serves as both the entry point (Sentinel-IN) and the exit point (Sentinel-OUT) for all interactions with the AI system.\n\nSentinel protects the system from malicious inputs (Prompt Injection) and ensures the safety and privacy of AI outputs (PII re-emergence, Hallucination filtering).\n\n## Key Features\n### Sentinel-IN (Input Gateway)\n- **Prompt Injection Detection:** Multi-layered detection using regex, keywords, and ML models to block unauthorized instructions.\n- **Metadata Verification:** Validates the structure and content of request metadata (e.g., UUIDs, tenant identifiers).\n\n### Sentinel-OUT (Output Gateway)\n- **PII Re-emergence Check:** Prevents the AI from accidentally revealing original PII that was previously anonymized.\n- **Hallucination Detection:** Compares LLM responses against retrieved context to identify ungrounded claims.\n- **Content Filtering:** Blocks inappropriate content, hate speech, and sensitive advice.\n- **Permission Boundary Enforcement:** Ensures the response level matches the user's access permissions (e.g., K-anonymity).\n\n## Architecture\n- **Validation Engine:** A shared core that executes detection rules in parallel.\n- **ML Scorer:** ONNX-based inference for identifying complex injection patterns and hallucinations.\n- **Unified API:** Single service handling both `/v1/validate/input` and `/v1/validate/output`.\n- **Streaming Support:** Real-time token-by-token validation for LLM responses.\n\n## Getting Started\n### Prerequisites\n- Go 1.25+\n- ONNX Runtime 1.16+\n- Redis (Optional, for caching)\n\n### Installation\n```bash\ngo build -o sentinel ./cmd/sentinel\n```\n\n### Running the Server\n```bash\n# Run from the module root: the engine loads PII patterns from the relative\n# path external/pii-pattern-engine/regex, so the working directory matters.\n./sentinel server\n```\nThe server starts with a built-in default configuration (REST `:8080`, gRPC\n`:9090`). To override it, pass a YAML file with `--config \u003cpath\u003e`; see the\nconfigurable keys below.\n\n### Configurable detection patterns\nThe regexes used by the output validators and industry compliance filters are\nexternalized to the YAML config — override them without touching code. Every\nfield is optional; when omitted the built-in default is used, and an invalid\noverride falls back to the default. Available keys:\n\n```yaml\noutput_validation:\n  hallucination:\n    claim_patterns:\n      numerical:  \"\"   # default: \\b\\d{1,3}(?:,\\d{3})*(?:\\.\\d+)?(?:\\s*(?:만|억|천|M|K|B))?\\b\n      date:       \"\"   # default: \\b\\d{4}[-./]\\d{1,2}[-./]\\d{1,2}\\b|\\b\\d{1,2}[-./]\\d{1,2}[-./]\\d{4}\\b\n      percentage: \"\"   # default: \\b\\d+(?:\\.\\d+)?%\\b\n  permission_check:\n    specific_amount_pattern: \"\"   # default amount-detection regex\n\n# Industry compliance filters accept per-filter regex/keyword overrides.\n# When patterns/keywords are empty the built-in HIPAA/GDPR/PCI/ITAR sets apply.\nindustry:\n  filters:\n    - builtin: hipaa\n      action_on_match: redact\n      patterns: []     # empty → DefaultHIPAAPatterns\n      keywords: []\n```\n\n## Documentation\n- [Design Document](DESIGN.md)\n- [SRS Document](docs/bastion_sentinel_srs_v1.0_en.md)\n- [Output SRS Document](docs/bastion_sentinel_output_srs_v1.0_en.md)\n\n**Technical deep-dives (code-based):**\n- [Prompt Injection Detection](docs/prompt-injection-detection.md)\n- [Metadata Filtering](docs/metadata-filtering.md)\n\n## Testing \u0026 Fixtures\nFixture files live in `tests/fixtures/` as JSONL. The `\"timestamp\":\"NOW\"` placeholder is substituted with the current UTC time at runtime.\n\n---\n\n## Technical Stack\n\n| Component | Technology |\n|-----------|------------|\n| Language | Go 1.25+ |\n| gRPC / Protobuf | `google.golang.org/grpc` v1.64, `google.golang.org/protobuf` v1.36 |\n| Caching | Redis 7.0+ (optional) via `github.com/redis/go-redis/v9` |\n| CLI framework | `github.com/spf13/cobra` |\n| Config | YAML via `gopkg.in/yaml.v3` |\n| Metrics | Prometheus via `github.com/prometheus/client_golang` v1.23 |\n| Logging | Structured JSON via `log/slog` (stdlib) |\n| ML inference | `ml.Scorer` interface — `OnnxStub` active (returns 0.0); replace with `github.com/yalue/onnxruntime_go` |\n\n---\n\n## Implementation Status\n\n### Sentinel-IN (Input Validation)\n\n| Feature | Status |\n|---------|--------|\n| Prompt injection detection (regex + keyword) | ✅ |\n| Metadata validation (schema + business rules) | ✅ |\n| REST API (validate, batch, health, config) | ✅ |\n| gRPC API (Validate, ValidateBatch, Health) | ✅ |\n| Redis caching with in-memory fallback | ✅ |\n| CLI (validate, try, testrun, interactive, config, server) | ✅ |\n| Hot config reload via `POST /v1/config/reload` | ✅ |\n| Payload size limits (10k chars / 4KB metadata) | ✅ |\n| Kubernetes health probes (`/health/live`, `/health/ready`) | ✅ |\n| Prometheus metrics with injection score histogram | ✅ |\n| SIGHUP hot reload | ✅ |\n| Structured logging — `log/slog` JSON + Elasticsearch shipping | ✅ |\n| Security incident alerts (Slack / PagerDuty) | ✅ |\n| Batch progress bar | ✅ |\n| Engine benchmarks (`go test -bench=.`) | ✅ |\n| Dockerfile (multi-stage Alpine) | ✅ |\n| Kubernetes manifests + HPA | ✅ |\n| Integration docker-compose + k6 load test | ✅ |\n| ML inference (ONNX) | Stub only |\n\n### Sentinel-OUT (Output Validation)\n\n| Feature | Status |\n|---------|--------|\n| PII re-emergence detection (6 pattern families, EN + KR) | ✅ |\n| PII auto-sanitization with modification log | ✅ |\n| Hallucination detection (lexical grounding, claim extraction) | ✅ |\n| Content filter (API keys, cloud credentials, internal paths) | ✅ |\n| Permission boundary check (access level hierarchy) | ✅ |\n| Format validation (length, UTF-8, control chars) | ✅ |\n| REST API (`POST /v1/validate/output`, `/v1/validate/output/batch`) | ✅ |\n| CLI (`validate-output` with `--explain`, `--access-level`) | ✅ |\n| Streaming output validation | Stub (future) |\n| Vault PII mapping cross-reference | Stub (pending Vault integration) |\n\n---\n\n## Performance Targets\n\n| Metric | Target |\n|--------|--------|\n| Median latency (p50) | \u003c 0.5 ms |\n| Long-tail latency (p95) | \u003c 1.0 ms |\n| Throughput | ≥ 40,000 req/s |\n| Detection accuracy | ≥ 95% |\n\n---\n\n## Other modules\n* [Vault](../vault)\n* [Navigator](../navigator)\n* [Anchor](../anchor)\n* [Tracker](../tracker)\n\n---\n\n\n## License\nApache License 2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzafrem%2Fbastion-sentinel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzafrem%2Fbastion-sentinel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzafrem%2Fbastion-sentinel/lists"}