SentnelOpsFAQ & troubleshooting
Short answers to the questions everyone asks, and fixes for the handful of things that actually go wrong.
Do I need to change my AI agent's code?
No. The integration is one configuration line: swap the address your AI uses to reach its tools for the SentnelOps proxy address, and add its agent token as a header. The agent's code, prompts, and tools stay exactly as they are — Connect your AI tools shows the exact line for each client.
Will it slow my agents down?
Not noticeably. The proxy forwards calls byte-identical, streams are never buffered, and logging happens off the hot path — measured p99 added latency is under 2 ms. For comparison, the AI model itself typically takes hundreds of milliseconds per step.
What does SentnelOps see, and where does my data go?
The proxy records each tool call's metadata: which agent called which tool, with what parameters, how long it took, and the outcome. Your tool responses pass straight through to your agent. By default nothing leaves the platform: alerting integrations (Slack, email) are off until you configure them — unset means zero egress, with events logged locally. If even that is too much, the entire stack can run inside your own network — see Advanced & self-hosting.
What if SentnelOps goes down?
Failure behaviour is explicit, never silent. The shipped default is fail-open: if the policy engine can't make a decision, the call passes and a warning is logged — governance problems never become outages. Environments where blocking matters more than uptime can be set to fail-closed instead, per environment, in your policy (edited on the Policy page) — see Enforcement & approvals.
Troubleshooting
| Symptom | What it means | Fix |
|---|---|---|
401 unauthorized | The proxy doesn't recognise the token — missing, mistyped, or rotated | Re-check the Authorization: Bearer … header in your client config. If the token was rotated, the old one is dead — paste the new one from the rotation. |
404 | The server name in the proxy address isn't registered for your org | Register it (step 2 of Connect your AI tools) and make sure the name in the URL matches exactly. |
| Nothing in the Live calls feed | Your AI is still calling the tool service directly, not through SentnelOps | Confirm the client's MCP URL points at https://api.sentnelops.com/proxy/…, then restart the client so it re-reads its config. |
| Production agent won't work | Production agents start as draft — they don't get a working badge until approved | A different person than the creator must approve it, then it can be activated — see Lifecycle & audit. |
429 | Rate limit — too many requests in one minute | Wait for the window to reset (the X-RateLimit-Reset header says when) and retry. |
How do I stop an agent right now?
Open the agent's page in the dashboard — both safety switches are buttons at the top, and both take effect within seconds. Suspend asks for a reason (required — it goes in the audit trail), blocks the agent immediately, and freezes its scope until someone clicks Reactivate; it needs the security role. Rotate token issues a fresh credential and revokes the old one on the spot — every later call with the old token is rejected with a 401. Rotation is the fastest single click; suspension leaves the clearer paper trail.
Who can do what?
| Role | Can |
|---|---|
viewer | See everything — the registry, calls, audit trail. Change nothing. |
developer | Everything above, plus register and update agents, rotate tokens, activate. |
security | Everything above, plus lifecycle decisions (approve, suspend), the MCP server registry, editing the org's policy, and approval decisions. |
admin | Everything above, plus manage user accounts and org settings. |
One guard rail worth knowing: an org can never lock itself out — the last active admin cannot be demoted or disabled (the API refuses with a 409). More detail in Teams & roles.