Sentinel — an autonomous data-compliance loop that hires its intelligence

Loop Engineering Hackathon 2026 · tokens&

Sentinel is a self-directing agent that watches a Nexla data product and keeps it compliant. The twist: when it hits a judgment call its own code can't make — does this record contain PII? is this source IP hostile? — it doesn't guess and doesn't ship a model of its own. It searches the Zero marketplace, hires the right capability, pays per call in USDC (x402/MPP), and enforces the verdict on the real control planes: Nexla (mask the leaking field) and Pomerium (lock the route down with a deny policy).

That's the loop-engineering idea taken literally: an agent that extends its own abilities at runtime by buying them, instead of being frozen at whatever it shipped with.

 OBSERVE   pull records off the Nexla stream
 ENRICH    for a flagged record, hire Zero capabilities  ── real USDC ──▶ zero.xyz
             • PII Detector & Data Leak Scanner   ($0.02/call)
             • 2s.io IP Geolocation               ($0.001/call)
 DECIDE    turn the paid verdicts into an enforcement decision
 ACT       Nexla masking transform   +   Pomerium deny-policy lockdown
 VERIFY    re-read the stream and prove the leak & access are gone
 REPEAT

The native pre-filter is deterministic, so the healthy baseline costs $0 — only records that actually look risky are ever sent (and paid for) to Zero.

Why this hits every sponsor

Sponsor	Role in the loop	Not a mock
Zero (zero.xyz)	The agent's runtime intelligence — discovered + paid per call in USDC.	✅ Real x402 settlements on Base — receipts below.
Nexla	The data product being guarded; target of the masking transform.	Real dataops.nexla.io API — authenticates (service key → session token) and reads the live nexset. MOCK if no creds.
Pomerium	Identity-aware enforcement — a live route is locked behind a deny policy.	Real Pomerium Zero cluster (Pomerium Core in Docker, Zero-managed). The agent flips a gate policy allow→deny and a real HTTP 403 comes back through the running proxy.

Run it

python -m venv .venv && .venv/bin/pip install -r requirements.txt

# Bring up the REAL Pomerium Zero cluster (data plane the agent locks down):
docker compose up -d          # Pomerium Core (Zero-managed) + demo upstream

# Healthy baseline (green, no spend):
.venv/bin/python agent.py

# The save — inject a leaking record from a hostile IP (cached Zero replay, $0):
.venv/bin/python agent.py --trigger-attack

# The real thing — same loop, real paid Zero calls (~$0.021/attack cycle):
.venv/bin/python agent.py --trigger-attack --live-zero

--live-zero drives the actual zero CLI (already authenticated) and pays live. Without it, the loop replays captured real responses from fixtures/ so the demo is 100% reliable and free.

To hit Nexla/Pomerium for real, copy .env.example → .env. Nexla: add NEXLA_TOKEN (service key). Pomerium uses two credentials with two jobs: POMERIUM_ZERO_TOKEN (a Zero cluster token) boots the real proxy via docker compose, and POMERIUM_API_TOKEN (a console API-User token) lets the agent flip the gate policy (POMERIUM_POLICY_ID) on the guarded route. Base URLs are fixed, so there are no URL fields. With the data plane up and the API-User token set, ACT produces a genuine 403; without them it degrades honestly (no fake success).

Proof the Zero calls are real

Validated live end-to-end (see zero review history). Representative runs:

runId	Capability	Result	Charge	Chain
run_-ckNDJzfjiH3Bwh-5hBlp	PII Detector & Data Leak Scanner	risk=high, 5 entities, redacted	$0.020	Base (x402)
run_beNvFXdks5UBXY9wGp5O6	2s.io IP Geolocation	Germany · AS60729 (Tor-exit operator)	$0.001	Base (x402)

The attacker IP 185.220.101.5 really does resolve to AS60729 / Artikel10 e.V, a known Tor-exit operator — a genuine threat signal the agent bought, not a hardcoded string.

Layout

File	What it is
agent.py	The loop: observe → enrich(Zero) → decide → act → verify → repeat
zero_client.py	Hires Zero capabilities via the zero CLI; live-paid or cached replay
clients.py	Nexla client + Pomerium client (real Zero-managed cluster; flips the gate policy and verifies a real 403)
docker-compose.yml	Boots the real Zero-managed Pomerium Core + demo upstream the agent locks down
simulator.py	The Nexla record stream + the --trigger-attack leak scenario
fixtures/	Captured real Zero responses, replayed for a free/reliable demo