SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
Sentinel-RL keeps topology outside the LLM: a graph encoder and constrained policy choose SOC actions, while the model writes critic-gated narratives for human approval.
Sentinel-RL compresses an authentication graph with a graph-attention encoder, maps that state to constrained actions using PPO, and limits the LLM to recommendations and analyst-readable narratives. Its full human-approved loop had a **6.3 s median** runtime.
For security agents operating over large structured state, keep graph validity and action choice in deterministic or constrained components. Use the LLM at the semantic boundary, then place a critic and explicit approval before containment.
Sentinel-RL compresses an authentication graph with a graph-attention encoder, maps that state to constrained actions using PPO, and limits the LLM to recommendations and analyst-readable narratives. Its full human-approved loop had a **6.3 s median** runtime. For security agents operating over large structured state, keep graph validity and action choice in deterministic or constrained components. Use the LLM at the semantic boundary, then place a critic and explicit approval before containment. The reported results come from the **LANL dataset** and Indiana University’s Quartz cluster. Precision of **0.91** and recall of **0.87** were measured on labeled red-team events, not a broad production SOC deployment.
This supplies a concrete security-domain implementation of the broader pattern that LLMs should interpret and explain while constrained components manage structured state and consequential actions. It adds graph compression, PPO action selection, a critic, and human approval, with encouraging measured results and latency, but narrows the evidence to labeled red-team events on LANL data rather than establishing production SOC reliability.