Every change, observed.

Observation, Not Judgment

Continuous monitoring in a compliance program answers three questions on a loop: what exists, what changed, and what still proves each control. Most programs answer them with a stack of bolted-together tools; an inventory crawler, an evidence collector, a change detector, each with its own credentials, its own scheduler, its own blind spots. The deeper failure is structural. When the tool that collects a fact also grades it, provenance collapses: the collector becomes the judge of its own record, and an assessor who asks how you know gets a dashboard instead of a chain. The GRC tooling most teams inherit makes the opposite error and collects nothing at all, grading narratives instead of systems.

Sentinel's design answer is a hard boundary. The architecture holds Sentinel as the platform's observation limb: it observes the world and emits observations, and it never rules on what an observation means. Satisfaction, scoring, and findings belong to Rampart; the durable estate record belongs to Garrison. Every byte Sentinel collects enters the platform marked tainted, by declaration: observations inform posture computation and never authorize a ruling. The boundary against log sprawl is drawn just as deliberately. Sentinel ingests security-relevant, compliance-scoped signals only; it is not a general-purpose SIEM, and a customer's SIEM connects as one more signal source while log-lake economics stay where they belong. In the platform's own mnemonic set, Garrison is what you HAVE, Vanguard is what you DO, Rampart is what you are PROVING. Sentinel is what is HAPPENING.

One Connector Interface

Real estates are heterogeneous: cloud accounts, identity directories, network devices, legacy servers in a manufacturing closet, an enclave with no route to the internet. The standard integration model treats each source as a project. Every provider gets bespoke collection code, bespoke retry logic, bespoke failure handling, and every new source multiplies the surface where coverage claims quietly go stale. Integration sprawl is not an engineering annoyance; it is where a missed source becomes a missed control.

The architecture holds one connector contract with six methods: capabilities, authenticate, discover, collect, subscribe, and healthCheck. A connector observes a foreign world; it never modifies one. Adding a provider is implementing the interface and adding a registry row: the scheduler, the collection graph, the healing classifier, and the profile resolver do not change. The registry itself is signed reference data, never a tenant write, and it enumerates twelve connector kinds across four handling classes: platform-run collection over provider APIs, resident edge collection, an import path for artifacts the platform never collected, and customer-plane rules deployed inside the customer's own account. Credential discipline is part of the contract. Connection handles are short-lived by law, no long-lived secret is ever held, and a credential value never lands in a Sentinel table; a connection carries a reference into identity custody instead. Capability cells are executable data: a profile class a registry row does not declare cannot be scheduled against that connector, so a coverage claim is something the platform checks rather than prose an auditor must trust.

Four Questions, Declared

The design specifies four collection profile classes, each a question asked of the world. Discovery asks what exists; its resource observations are the feed the estate projects from, which is how discovery populates the inventory Garrison presents. That same discovery record is designed to serve the component inventory control (CM-8) in NIST 800-53: enumeration with configuration capture at a derived cadence, every component an observation carrying provenance and a freshness horizon rather than a spreadsheet row. Evidence asks whether a control can be shown satisfied; its artifact observations bind to a control requirement. Compliance-scan asks whether a target passes its checks, and here the boundary is exact: Sentinel schedules and triggers, Vanguard runs the scanners, including DISA STIG and CIS Benchmark checks, and results return as trends. Monitoring asks what changed, producing change observations and drift events.

Profiles are declarative. A profile declares what must be observed, never which collector to run; a resolver binds the declaration to the discovered world and records its choice, so the binding is auditable. A control's evidence requirement arrives from Rampart as a property to be shown, not a collector name, which is what lets one declared requirement resolve differently in different environments without anyone rewriting it. Profile scope rides the organization's unit tree under an inherit-down law: a profile declared at the org root covers the org, a deeper unit narrows it, and most-specific wins. Nothing flows up or sideways, so a profile can never widen its own reach; that is an authority rule applied to observation, refused at declaration rather than discovered at run time.

Schedules Are Derived, Never Hand-Set

The naive cadence polls everything at the same interval, and it fails in both directions at once: compute burned re-reading static infrastructure, and stale beliefs about the volatile slice that actually moves. It fails a third way that few teams price in. An aggressive monitoring loop can consume a provider's API quota and starve the customer's own automation, which turns oversight into an outage of the customer's making but the tool's cause.

In Sentinel's design, no schedule is hand-set. The interval for a profile against a target is computed from four named inputs: the freshness horizon of the belief the observation supports, the observed change frequency of the target, the connector's quota posture, and the posture weight of what the observation feeds. Every input lands in a recorded derivation basis, so a cadence is an auditable decision rather than tuning folklore. Derived intervals clamp between a floor of 300 seconds and a ceiling of 24 hours; a value outside the clamp is a derivation defect, not a tuning question. Quota is treated as a shared resource: the design reserves a fifth of a provider's remaining quota that collection will not consume, and throttle is a scheduling input rather than a failure, so quota pressure widens the derived interval instead of producing a retry storm. A freshness breach is not a missed cron tick. Expiry raises a re-observation demand as a first-class event, and the scheduler serves a demand ahead of standing cadence within one scheduler tick, because a stale belief is a posture problem, not a backlog item.

Provenance, Taint, and Contested Beliefs

Evidence is only as strong as its origin story. A screenshot proves that a screen once looked a certain way; it does not carry who collected it, through which credential, from what system, at what moment. And when two tools disagree about one resource, most programs resolve the conflict socially: someone picks the number they prefer, and the spreadsheet remembers nothing about the choice. Assessors have learned to discount all of it, and they are right to.

Sentinel's observation contract makes provenance structural. Every observation carries its connector, credential class, transport plane, and collection mode; a SHA-256 digest over its canonical body; and two timestamps, one for when the world was in that state and one for when the platform recorded it. An observation without provenance or without its taint channel never lands: the collection run fails rather than emitting an unproven fact. Taint is typed into the contract as the literal value true, so an untainted observation is a type error rather than a review comment. Disagreement is first-class. When two sources produce conflicting observations of one subject, the belief moves to a contested state, never to a silent winner; resolution is re-observation, a quorum of two independently concurring observations, or escalation to a human, and the losing observation is superseded rather than erased. This is the collection half of infrastructure as evidence: every fact enters carrying what an assessor would need to interrogate it.

Drift Detection

Drift is the gap between what an estate declares and what it currently is, and it accumulates in exactly the places review cycles do not reach. Quarterly snapshots are stale when filed; drift discovered in November cannot be remediated in October. Change-control boards have the inverse blind spot: an approval workflow governs the changes that asked permission, and the dangerous change is the one that never filed a ticket.

In the design, the monitoring profile and the customer-plane event rules carry change as it occurs, and every change event is structured rather than merely logged: the prior and new configuration digests, a drift class of access, structure, config, or lifecycle, and a significance verdict of posture-bearing or informational. Because every captured configuration is content-addressed by its digest, a changed byte is a changed digest, and integrity drift is detected by construction rather than by scanning for it. What happens next respects the boundary. Posture-bearing change events flow to Rampart, where change events re-evaluate posture, and drift alarms surface in Citadel. Sentinel classifies what changed; it never scores the control the change touches, and it never mints the finding. Interpretation stays on the other side of the seam, which is precisely what makes the observation credible when it gets there.

Self-Healing Collection

Collection fails constantly in real estates. Credentials expire. Permissions vanish in an IAM cleanup. Targets get deleted. Providers throttle. Most monitoring handles all of it one way, a generic retry, and when the retry gives out it fails silently. Silence then reads as health, and the first person to notice the six-week evidence gap is the assessor.

Sentinel's design classifies failure into five classes and gives each its own typed adaptation. Transient faults back off on a declared ladder and retry. A rejected credential triggers rotation at the identity seam and retries once; a second rejection escalates rather than looping on a bad secret. A permission denial fails closed and reports the exact missing grant, so the operator receives the provider-side permission to fix instead of a bare refusal. A vanished target retires its subject, with the disappearance recorded as the provenance of the gap. A faulting connector circuit-breaks while last-known observations hold at their existing horizons, because a broken connector must not be allowed to expire the world by failing quietly. Around all five sit two disciplines. Silence is a state, never a verdict: a connection silent past twice its probe interval reads UNKNOWN, never assumed healthy. And a partial run never narrows the world: observed subjects stand, while unobserved subjects keep their prior belief and its horizon. The temperament is fail-closed for one reason. A collection that cannot prove what it saw records nothing, rather than recording a guess.

Freshness and Continuous Authorization

Evidence decays. A configuration snapshot proves a little less every day it ages, and most compliance programs meet that fact exactly once a year, during assessment preparation, when expired evidence is discovered in bulk and re-collected in a panic sprint. The sprint is not just painful; it quietly converts continuous requirements into annual ones, which is how authorization backlogs are made.

In the architecture, every observation carries a freshness horizon declared by the belief class it serves, with a default of 24 hours set per profile class rather than guessed globally; evidence runs tighter, monitoring looser. Past its horizon a belief demotes to expired. It is never deleted, and the expired record remains as the provenance of the gap. Expiry emits a re-observation demand, and the scheduler serves demands ahead of standing cadence. This is Sentinel's half of the evidence fabric: the collection-to-satisfaction pipeline, the expiration workflow, continuous freshness. The composition is the point of the whole design: collection drives continuous authorization. Rampart holds authorization as live state, and a point-in-time assessment is a projection computed from that state; the projection is only current because the observations beneath it are. Freshness is not hygiene. It is the property that separates computed posture from an assembled binder.

Cloud, Customer Plane, and Air Gaps

The design reaches estates through distinct transport paths, stated per connector kind. Platform-run connectors collect over provider APIs from a blast-isolated, egress-heavy collection cell, so a hostile provider response cannot reach the domain core. Customer-plane connectors work from the other side: a least-privilege event-rule set deployed inside the customer's own cloud account, every rule named under the platform's redoubt prefix, streams provider events so change arrives as it happens rather than at the next poll. Provider security findings are ingested rather than recomputed: the vulnerability, threat, posture, and access-analysis outputs a provider has already published enter as observations through a findings-class connector, and the provider's own declared-versus-observed configuration verdicts enter the same way, so findings that already exist are contextualized instead of duplicated. A customer's SIEM connects as a compliance-scoped signal source; the log lake stays the customer's.

Air-gapped and disconnected estates keep the same integrity guarantees, because the observation contract does not depend on connectivity. The import path accepts artifacts the platform never collected: results produced inside an isolated network, uploaded through the authenticated CLI surface with an artifact digest taken at receipt. The redoubt CLI itself is the ephemeral, developer-grade slice of collection: scan, collect, check, with no residency, where the invoking human or CI job is the scheduler. A resident edge agent, a superset of the CLI on one codebase, is under consideration at Sentinel's charter for estates that need persistent local collection. And targets that predate any connected system have a home of their own: saved scan targets live in Outpost and graduate into the Garrison estate, where Sentinel monitoring picks them up. Wherever an observation is born, it lands in the same record with the same provenance and the same horizon.