OnChain Sentinel Features

The PGTAIL engine evaluates every proposed transaction against your active policy before funds move. 60+ active threat guards across 9 categories. Structured decisions — allow, warn, hold, or block — with a full audit log. Policy is fully yours.

60+ active guardsFail-closed by defaultFull audit logAPI-nativeProduction on AWS

How PGTAIL Responds

Every evaluation returns one of four structured outcomes. Blocks occur only when policy explicitly demands them — clear deny-list matches, posture-defined thresholds, or guard-level triggers. Nothing is blocked on ambiguity alone.

Allow

Transaction passes all active guards and policy thresholds. No action required.

Warn

One or more guards flagged. Transaction can proceed but the user is notified.

Hold

Elevated risk. Transaction paused pending user confirmation within the hold window.

Block

Policy demands a stop — deny-list match, posture threshold exceeded, or guard trigger met.

Guard Coverage

All guards are active in production today (Phase 1). Guards flagged Phase 2 or Phase 4 are defined and sequenced but not yet deployed.

Registry Enforcement

Live

·Blacklist — deny-list destination matching
·Graylist — elevated-scrutiny destination matching
·Whitelist — approved destination fast-pass

Trust Range

Live

·Sovereign Cap — per-transaction spend ceiling
·Risk floor — auto-approve threshold
·Block threshold — auto-block threshold
·Confidence ceiling — minimum evaluation confidence required
·Hold timeout — max hold window before escalation
·Hardware wallet gate — MFA required above threshold

Behavioral — Dusting

Live

·Dust ceiling — USD threshold for dust detection
·Mature wallet dust block threshold
·Inbound dust caution risk
·Minimum inbound amount guard

Behavioral — Peeling Chain

Live

·Heavy recipient spread detection
·Suspected recipient spread detection
·Fast peel window timing
·Bot-like transaction timing
·Even-division tolerance
·History depth — sparse wallet detection

Wallet & Signature

Live

·Address poisoning detection
·EIP-712 / Permit signature guard
·First-interaction scrutiny (chilled mode)

Token & Asset

Live

·Honeypot / rug pull detection
·Airdrop token block
·Stolen asset tagging
·Stablecoin depeg monitoring

Allowance & Approval

Live

·Allowance firewall — approval size limits
·Approval simulation before signing
·Multi-step drain detection
·ERC-4337 factory / paymaster control

Network & Protocol

Live

·Sanctions screening
·Contract upgrade risk detection
·DeFi protocol health check
·Bridge health check
·Gas price guard

Transaction Behavior

Live

·Velocity guard — rolling spend pattern
·Composite signal detection
·Wash sale awareness
·8 per-guard sensitivity overrides

Policy Configurator

Five named postures cover the range from standard to absolute zero-trust. Every posture is a complete, consistent guard configuration — not just a label. A Custom posture gives full per-guard and per-threshold control. Policy deploys to the engine immediately and applies to every subsequent evaluation.

Posture

Behavior

Standard

Matches what institutional exchanges and cold wallets already provide — deny-list enforcement only, no active risk scoring, no spending caps, no behavioral guards. Nearly all transactions auto-approve. Not an OCS upgrade; the baseline you start from.

Basic

The first step above industry standard. Active risk scoring engages: $100/24-hour spending cap, risk floor at 20, block threshold at 60. Address poisoning detection on. Approval drainer, permit drainer, and token impersonation guards active. Transactions scoring above the floor are flagged; those above 60 are stopped.

Institutional

High-volume, high-value tuning. $100k/24h cap, risk floor 50, block at 90. Full behavioral guard stack: honeypot, stablecoin depeg, wash sale, composite signal, approval tracking, contract upgrade risk. Calibrated for treasury and organizational wallets where friction must be bounded but protection must be real.

Enhanced

Personal-wallet protection above Institutional. $500/24h cap, graylist blocks (not just warns), incident switch on by default, gas price guard active. Every guard on. For users who want strong defaults without the absolute zero-tolerance of Zero-Trust.

Zero-Trust

Maximum protection. $0 sovereign cap — every transaction requires confirmation regardless of size. Risk floor 0, block threshold 50, confidence ceiling 100%. 1-minute hold window. Hardware wallet gate enforced. Nothing auto-approves — any ambiguity holds for your review.

Custom

Full per-guard and per-threshold control. Start from any named posture, edit anything, then deploy — policy is stored as your custom profile on the engine.

Infrastructure

AWS Deployment

EC2 + RDS PostgreSQL + ECR + ALB + ACM. Health endpoints and Prometheus observability.

Docker Containerized

Reproducible builds with SBOM attestation and Sigstore/Cosign provenance.

Fail-Closed Architecture

Engine unavailable = block. Ambiguity = protection. No silent pass-throughs.

PostgreSQL Persistence

Full policy persistence. All deployed postures, overrides, and guard states stored in RDS.

Incident Switch

Global lock-down mode. When active, PGTAIL blocks all destinations not on the approved whitelist.

Audit Log

Every decision logged with guard results, scores, policy state at evaluation time. Reviewable and exportable.

On the Roadmap

The following capabilities are defined and sequenced but not yet in production:

Phase 2 — Forensics: Case intake workflow, transaction graph analysis, pattern-to-policy feedback loop, law enforcement evidence packages, audit-grade chain of custody
Phase 3 — Institutional API: Enterprise SDK, SLA-backed uptime, batch evaluation, institutional policy templates, compliance report generation
Phase 4 — Protocol-Native Enforcement: Smart account contracts on public testnet; sequencer-level integration when infrastructure is ready