Renan Raad — AI Agent Security Architect · Founder, Sentinel Forge
This repository is not a portfolio of claims. It is a set of signed, sanitized records of real defensive work, each shipped with a SHA-256 sidecar so that any third party can verify integrity without trusting me.
Every record follows the same discipline (the five laws of my governance framework, Sentinel Forge):
- Core first — proof before expansion.
- Authority Gate — no explicit, verifiable authorization → the flow halts before execution.
- Evidence over trust — BLOCKED is a valid result; insufficient evidence never yields PASS.
- Reversibility always — prior state, rollback method, recovery test.
- Counterevidence mandatory — every conclusion records what would invalidate it.
A consequence you will see inside these documents: the failures are published too. An access-control experiment that failed its negative test is reported as a failure and replaced — not papered over (see the LGPD record, §2).
Every artifact has a .sha256 sidecar. On any machine:
# Linux / macOS
sha256sum -c <file>.sha256
# Windows (PowerShell)
(Get-FileHash <file> -Algorithm SHA256).Hash
Compare against the sidecar. If the hash does not match, do not trust the file — that is the entire point.
| File | Language | Summary |
|---|---|---|
article/artigo-autorrelato-llm-v1.0-en.pdf |
EN | Non-auditable self-report in LLMs. The interface showed "Searching 7 sites"; asked whether it had searched, the model answered "No", then admitted the contradiction in writing. The case does not prove "AI lies" — it demonstrates something operationally worse: models confidently report internal states they cannot audit. Operational rule derived: every tool action must be logged by a layer outside the model, and audits consult the log — never the agent. |
article/artigo-autorrelato-llm-v1.0.pdf |
PT-BR | Original full version of the case study. |
| Record | What it demonstrates |
|---|---|
LAB_RECORD_DATA_REPATRIATION |
Full cloud-to-local data repatriation under operator control. |
LAB_RECORD_DESKTOP_ICONS |
Root-cause isolation of stale per-process shell state on Windows 11 — read-only evidence chain, Win32 live-view interrogation vs. fresh-process namespace, timeline-relative debugging ("already tried X" is meaningless without timestamps). |
LAB_RECORD_ICLOUD_LGPD |
Third-party health-data containment (LGPD): an ACL control that failed its negative test and was reported as a failure, replaced by encryption-at-rest with encrypted headers; passphrase custody structurally separated from the AI agent. |
LAB_RECORD_OFFLINE_BACKUP |
Offline encrypted backup with a 100%-explained gap census (33 excluded items, each individually verified and classified), including a governance decision: live runtime state of a gated system is deliberately not backed up — restoring it would be an ungated-reactivation vector. |
LAB_RECORD_CLOUD_DECOMMISSION |
Inventory-first teardown of two cloud accounts with a structural authority split: the AI agent stages reversible deletions; permanent deletion is prohibited to the agent even when authorized — the irreversible click stays human. |
These operations were orchestrated by a human operator working with an AI agent (Claude, via Claude Code). The division is structural, not cosmetic: the agent diagnoses, stages reversible actions, and drafts records; the operator holds passphrases, authorizes scope, and executes every irreversible action personally. Capability ≠ Authority.
All records are classified public/sanitized: no account identifiers, no data-subject names, no passphrases, no machine-specific identifiers beyond what the technical content requires. Operational by-products that embedded sensitive data (e.g., an ACL backup containing cleartext names) were destroyed and that destruction is itself documented.
- GitHub: github.com/aisamuraiagent-source — sanitized defensive labs (threat modeling, safe AI-agent operation, remediation, patch validation).
- LinkedIn: linkedin.com/in/renanraad