SentinelLM
An LLM safety proxy with input policy, output evaluation, and an audit trail.
Python · FastAPI · PostgreSQL · Redis · Next.js
View sourceThe problem
Every team wiring an LLM into production rebuilds the same safety layer badly: a regex for PII, a vibes-based prompt-injection check, no audit trail, and no idea what the model actually returned to users last Tuesday. Meanwhile the safety layer itself becomes a single point of failure: when it breaks, the product breaks.
The approach
- Sit in the request path as a proxy so existing code changes one base URL, not its architecture.
- Run enabled checks concurrently at the input and output boundaries, with input policy able to block before the model call.
- Treat every decision as an auditable event, because 'the model said something bad' is only actionable with the record attached.
Inside the system
Proxy
A FastAPI service fronting OpenAI, Anthropic, Gemini and Ollama behind one interface, routing every request through the evaluation pipeline.
Evaluators
Three input checks cover PII, prompt injection, and topic policy; five output checks score toxicity, exfiltration, relevance, hallucination, and faithfulness. Enabled checks run concurrently within each boundary. Input policy can block a request; output checks flag and log the model response for review.
Observability
PostgreSQL-backed audit logging, WebSocket streaming for live monitoring, and a Next.js dashboard surfacing risk scores, flagged outputs and a structured human review queue.
Decisions and trade-offs
Fail-open, deliberately
A safety layer that takes the product down with it gets removed within a week. SentinelLM degrades to pass-through and logs loudly rather than blocking the request path. The alarm is worth more than the gate.
Concurrent evaluation
Enabled evaluators run concurrently inside their input or output phase, instead of adding each check's latency in series. Input checks finish before the model call; output checks inspect the response afterward.
Humans in the loop, on purpose
Automated scoring flags; it doesn't adjudicate. The review workflow exists because the interesting failures are the ones the classifier was unsure about.
What it produces
- One integration point covering four model providers.
- Full request-level audit history, streamed live rather than reconstructed after an incident.