Architecture Reference Library
SENTINEL
Application Architecture, Data Lineage & Operational Mapping
Global Center for Technology and Intelligence (GCTI) · Architecture baseline v1.0 · 14 October 2026
Reference baseline, not a production attestation.
Requirements and observations below are transcribed from the source dated 14 October 2026. Adding this reference does not implement or verify these controls, certify pricing, or approve a release.
Release remains on HOLD until all P0 rows pass with dated, reproducible evidence.
1. Purpose and decisive architecture
Sentinel (https://sentinel.globalctinstitute.org) is the customer-facing / operational AEGIS console. It must present governed, attributable and entitlement-limited intelligence products generated from approved AEGIS and DTM system records. ECC controls operational compliance and corrective-action oversight; GCTI Press is the controlled documentation and release archive. Sentinel is not automatically the authoritative system of record for payments, research evidence or intelligence collection.
Verified observation: The public URL resolves to an AEGIS page directory advertising a Sentinel Hub and numerous AEGIS screens (including reports, risk engine, subscriptions administration, RBAC, systems check and verification). Access to a page URL does not prove a functioning backend, protected content, data freshness, licensing or subscription enforcement. Connected Base44 AEGIS source was inspected separately; deployed-build-to-source equivalence remains unverified.
2. System context and boundaries
| System / surface | Required responsibility | Data direction / control |
|---|---|---|
| Sentinel / AEGIS Console | Authenticated user experience, triage, analysis review, authorized exports | Reads approved AEGIS intelligence and DTM decisions; writes scoped case actions |
| AEGIS analytic/orchestration engine | Risk scoring, cyber/threat workflows, alerts, scenarios, agent outputs | Publishes signed, versioned analytic artifacts to governed interface |
| DTM Threat Intelligence Platform | Decision models, structured judgments, uncertainty, forecast calibration | Publishes evaluated assessments with assumptions, confidence and time horizon |
| Daily Brief / subscription portal | Packaging and delivery for subscription-specific reports | Consumes approved AEGIS/DTM products; does not replace their sources |
| ECC | Asset, compliance, service health, ownership, incident and corrective-action ledger | Receives status, lineage, validation and exceptions; not raw cross-tenant findings |
| Identity / Microsoft Entra | Enterprise identity, SSO, MFA, groups | Issues user identity and group claims; app must independently enforce permissions |
| Stripe / commercial ledger | Subscription payment and billing status | Signed webhooks/authoritative subscription lookup -> entitlement service |
| GCTI Press Publishing Enterprise | Controlled documentation, published versions, approvals, IP and retention | Receives mapping, release records, reports where approved |
3. End-to-end logical flow
External approved sources -> ingestion connectors -> raw evidence store + source metadata -> parsing/deduplication -> quality, legality and provenance gates -> AEGIS correlation/risk/alerts + DTM scenarios/decision modeling -> analyst verification + supervisory approval -> immutable report version + entitlement labels -> Sentinel authenticated interface -> Daily Brief tier packaging / controlled export -> audit events and ECC attestations -> Publishing House records.
Gate rule: If provenance, authorization, corroboration, recency or approval is missing, label output “unverified / draft” and prevent publication as validated intelligence. Model-generated hypotheses must never be represented as observed facts.
4. Page and capability mapping
| Capability family | Observed UI names / source evidence | Target behavior | Current assurance |
|---|---|---|---|
| Command / monitoring | Dashboard, Alerts Dashboard, System Monitor, Systems Check | Real-time scoped indicators; clear health, timestamps and alert ownership | Page listed; operations unverified |
| Collection / ingestion | ACLED Connector, Research Data Hub, Current Events, Intelligence | Source registry, credentials, permitted uses, poll health, raw evidence lineage | Pages listed; connector operation unverified |
| Analysis and scenarios | Risk Engine, Orchestrator, CART, scenarios, vertical GPTs, forecast calibration | Reproducible assessments; separate simulations from empirical observations | Pages listed; methodology not yet validated |
| Governance | Compliance, Governance, RBAC Matrix, SSO Config, API Key Management | MFA/SSO, server-side policy, audit, key lifecycle, segregation of duties | Pages and local RBAC definitions observed; effective controls unverified |
| Reporting | Reports, AIS Report, CTGG Reports, DTM Appendix Generator | Approved citations, confidence, caveats, version ID, audit trace | Report source includes synthetic/static content: CORRECTION REQUIRED |
| Commercial access | Pricing, Subscriptions Admin, Client Portal | Payment-linked entitlements and tenant/seat/licensing checks | Pages listed; enforcement unverified |
| Education / research | LMS, Courses, Training Manager, Aegis Learning | Clearly separated training/demo content; no production leakage | Page listing only |
5. Canonical intelligence data contract
Every ingested observation or derived product shall carry at minimum: product_id; source_id; source_url/document reference; collector; collection_time_utc; observed_time_utc; geography and entity; lawful-use/redistribution license; raw_content_hash (SHA-256); classification/sensitivity; tenant_id; analyst; corroboration_status; confidence_basis; analytic_method/version; uncertainty; model_version if AI used; review_status; approver; approved_at; expires_at / review_by; supersedes_id; distribution_tier; access_control_policy_version; evidence_links; correction_history; audit_id.
Keep source confidence distinct from analytic confidence. Every numerical score requires a published denominator/method and calibration evidence; otherwise display it as an experimental indicator rather than a validated probability.
6. Report production standards
| Product | Mandatory content / verification gate | Distribution design |
|---|---|---|
| Flash alert / immediate indicator | Timestamp, event, affected assets, sources, corroboration, what is unknown, recommended verification | Tier-based filtered advisory; no unconfirmed assertions |
| Daily intelligence brief | Key developments, citations, change since last issue, decision relevance, analyst caveats | Sentinel/Sovereign/Executive packaging |
| Threat / strategic assessment | Scope, problem, competing hypotheses, indicators, likelihood language, drivers, confidence, mitigations | Premium analyst/executive according to policy |
| DTM decision brief | Options, assumptions, constraints, sensitivity, uncertainty, decision triggers, ownership | Executive-authorized only when model output is proprietary |
| AEGIS technical incident / cyber report | Evidence chain, telemetry lineage, detection logic, severity, impact, remediation and peer review | Authorized security users only; never leak tenant-specific data |
| Scenario / wargame product | Scenario assumptions, simulated inputs, control runs, model limitations, outcome sensitivity | Clearly marked SIMULATION—not an observed threat fact |
| Compliance / audit attestation | Control ID, expected state, observed state, evidence, verifier, exception, due date | Operations/admin and permitted client scope |
7. Subscription, roles and feature entitlements
Pricing is a commercial decision and must be reconciled to live Stripe product/price IDs; no price in this document is certified. Prior business design differentiates Sentinel, Sovereign and Executive Daily Brief tiers, with standalone AEGIS and DTM app subscriptions / licensed seats. Do not equate a paid Daily Brief tier with automatic full console access.
| Role / subscription dimension | Permitted baseline | Restriction / enforcement |
|---|---|---|
| Public / prospect | Marketing and sanitized public content | No tenant intelligence, reports, API keys or admin data |
| Sentinel brief subscriber | Subscription-specific published brief/alerts | No raw AEGIS/DTM workspaces or executive decision models |
| Sovereign brief subscriber | Expanded approved analytical briefs and archives | No unrestricted proprietary engine or cross-tenant data |
| Executive brief subscriber | Executive decision products as contracted | Underlying DTM/AEGIS interactive apps separately licensed unless bundled explicitly |
| Analyst operator | Scoped case read/write and draft preparation | No unilateral self-approval of critical products |
| Reviewer / intelligence lead | Approve/reject scoped products, release authority | Cannot bypass data/tenant confidentiality rules |
| Tenant administrator | User provisioning and local policy within tenant | No platform-wide admin, cross-tenant exports or payment override |
| Platform security admin | Service maintenance and audit access | Privileged access logged, MFA, just-in-time where feasible |
8. Security, operating and publication controls
Required: OIDC/SAML identity validation; server-side RBAC + attribute-based tenant authorization; subscription checks per API request; default deny; MFA for privileged access; encrypted secrets; TLS; separate environment credentials; rate limiting; audit log integrity; data retention schedule; secure webhook signature/replay handling; automated integration contract tests; signed release attestations; incident response playbooks; backup restoration tests; export watermarking where appropriate; license compliance on source data.
Recommended standards to map against during formal compliance review: NIST CSF 2.0, NIST SP 800-53 control families, NIST SP 800-63 identity guidance, NIST SP 800-61 incident response, MITRE ATT&CK for cyber technique descriptions, STIX/TAXII where exchanging structured cyber indicators, and ICD 203 analytic tradecraft as a reference for sourced judgments. These references are design targets, not claims of accreditation or certification.
9. Evidence-based discrepancies and priority corrections
| ID | Finding | Priority / required correction | Acceptance evidence |
|---|---|---|---|
| SEN-001 | Public web index enumerates many potentially sensitive functions | P0: verify authenticated authorization on every route/API, do not trust navigation hiding | Unauthenticated / downgraded / cross-tenant denial test |
| SEN-002 | AEGIS Reports.jsx contains hard-coded example compliance / weekly intelligence entries | P0: remove or unambiguously watermark demos; use approved report-store records only | Generated archive maps to persistent IDs and source records |
| SEN-003 | Report archive displays Math.random() pseudo-file sizes | P1: derive actual stored file size and file type | File metadata matches downloaded artifact byte count |
| SEN-004 | RBACMatrix.jsx defines roles and subscriptions in client code, including “Pro ($99/mo)” | P0: separate display matrix from backend authorization, reconcile products to Stripe | Negative authorization tests + Stripe entitlement trace |
| SEN-005 | Live Sentinel domain and connected AEGIS source equivalence not established | P0: capture production deployment ID, git ref, build digest and domain mapping | Verifiable deployment provenance chain |
| SEN-006 | Live connector health, report review evidence and freshness not inspected | P0: run source-to-report reconciliation against real approved sample | Signed verification pack with timestamps |
| SEN-007 | Daily Brief and Sentinel API contracts / restrictions not verified | P1: version APIs, implement product-level sharing and tier filters | Contract + entitlements + redaction integration tests |
| SEN-008 | GCTI Press archiving / retention not confirmed | P1: publish approved mapping and attestation records to Publishing House | Document ID, version, reviewer, repository URL |
10. Minimum release acceptance test matrix
A. Identity: SSO login/logout, expired tokens, MFA, guest and privileged sessions.
B. Tenant isolation: direct-object reference, search, export, mutation and API paths denied for other tenants.
C. Entitlements: Stripe activation, downgrade, cancellation, webhook duplicates, failed payment, grace period.
D. Provenance: trace one actual observation to original source/hash, legal right and collection time.
E. Intelligence: corroboration, confidence rationale, uncertainty, source citations and approver replay.
F. Reporting: no demo data in production; drafts not published; versions, retractions, file hash, ZIP/PDF tests.
G. Integrations: AEGIS -> DTM -> Sentinel -> Daily Brief -> ECC events, retry/idempotency and failure state.
H. Operational security: secrets, TLS, audit trails, retention, backup/restore, alerts, load testing.
I. UX: mobile/desktop, accessible labels, explicit permissions, empty-state and broken-link checks.
11. Ownership, approvals and next actions
| Owner function | Accountability / evidence |
|---|---|
| Program / Product Owner | Approve audience, product packaging, report taxonomy and commercial terms |
| Technical / Platform Lead | Deployment mapping, API contracts, security patching and integration evidence |
| Intelligence / DTM Lead | Analytic methodology, approval workflows, source lineage and forecast calibration |
| Security / ECC | Control testing, risks, P0 escalation, audit acceptance and release gate |
| Commercial Operations | Stripe catalog reconciliation, fulfillment events and subscription lifecycle |
| Publishing House | Version-controlled mapping, IP/licensing notes and approved release record |
Release decision: HOLD until all P0 rows pass with dated, reproducible evidence. Separate “page exists,” “code exists,” “integration succeeded,” “user flow tested,” and “production attested” as distinct evidence states. No changes to deployed production were made as part of this mapping review.
12. Evidence register
E1: Live website page listing, https://sentinel.globalctinstitute.org (retrieved 2026-10-14): AEGIS / Sentinel Hub description and linked page index. E2: https://sentinel.globalctinstitute.org/Reports; E3: https://sentinel.globalctinstitute.org/SubscriptionsAdmin (page URLs publicly indexed, not functional validation). E4: Connected Base44 app “AEGIS,” app ID 68b8d1687c252a4f6d8e77b4: read-only inspection of pages.config.js, pages/Reports.jsx and pages/RBACMatrix.jsx (2026-10-14). E5: Connected Base44 app catalog identifies separate DTM Threat Intelligence Platform, ECC and GCTI Press Publishing Enterprise (deployment and integration unspecified).
Change control: Rev 1.0 — initial evidence-based architecture baseline; next revision requires production route/API inventory, subscription SKU export, tenant access tests, source-to-report verification and stakeholder sign-off.