Sentinel Technical Specifications

Detection types (10): person, vehicle, weapon, package, animal, face, license-plate, behavior (loitering / tailgating / wrong-direction), anomaly (baseline deviation), threat-score (weighted aggregate).

Confidence thresholds are configurable per detection type, per zone. Bounding boxes are normalized (0–1) so they survive resolution changes.

Watchlist matching runs face/plate detections against per-tenant watchlist entries. Matches trigger immediate alerts; matches are logged with confidence and reviewer feedback (true-positive / false-positive) for model improvement.

Anomaly detection builds per-zone behavior profiles (occupancy, motion frequency, access attempts) from observed activity over time. A profile moves from "learning" to "active" once it accumulates a sufficient sample size and confidence level, and goes stale (excluded from detection) if it isn't refreshed. Deviations from an active baseline trigger alerts with severity tiered by deviation magnitude.

Threat scoring combines weighted factors — person detected, after-hours, badge denied, motion-unusual — into a 0–1 composite score with per-factor justification surfaced to the operator.

Inference targets: edge GPU via the Bridge appliance (NVIDIA GTX 1070+ tested) or cloud fallback. Edge mode keeps frames on-premise — important for HIPAA / GDPR-sensitive sites.

Door / gate / turnstile / elevator / mantrap — five access-point shapes, all driven by the same access engine.

Controller protocols: Wiegand (26 / 34 / 37-bit), OSDP with Secure Channel encryption, BACnet, TCP, dry-relay, and standalone (reader makes its own decisions). Each access point can be re-protocoled without re-keying.

Readers: RFID (HID Prox), NFC (mobile wallet), biometric (fingerprint / face), keypad. Mobile credentials over BLE are first-class.

Anti-passback prevents badge sharing — a badge can't re-enter the same zone without first exiting. Configurable timer.

Mantrap interlock sequences two doors: outer opens, person enters vestibule, outer closes, then inner can open. Tailgating attempts (no inner open within delay) trigger an alarm with camera evidence attached.

Schedule-driven access: per access-point time windows, day-of-week rules, access-level overrides per holiday.

Lockdown cascade locks all access points in a zone (or all zones) in under a second and emits sentinel.lockdown.activated for cross-module response (fleet driver alerts, smart-spaces elevator restriction, helpdesk ticket creation).

Bridge serial-USB connects existing DSC, Honeywell, Bosch, Ademco, and Vista panels into the Aeion event bus — no rip-and-replace.

Partition state machine: disarmed → arming → armed_away / armed_stay / armed_night → entry_delay → alarm → tamper. Each transition is logged with actor, mode, and timestamp.

Entry / exit / alarm delays are configurable per partition (defaults: 30s entry, 60s exit, 5-min alarm duration).

Two-zone verification is the false-alarm killer — central station only dispatches when two zones trip within a configurable window OR when a camera confirms motion in the alarm zone.

Auto-arming schedules arm at a defined time on configured days; manual arm with PIN bypass is fully audited.

Panic types: fire, medical, police — each routes to a different central-station dispatch path.

Sensor bypass is logged and surfaced in the panel state UI so an operator can never forget a bypassed sensor.

Central station signal formats: SIA-DC09 (modern IP), Contact ID (legacy POTS), Ademco. The transport layer auto-selects per provider account.

Metric types (8): temperature, humidity, CO (carbon-monoxide), smoke, flood (water level), air quality index, pressure, custom.

Threshold rules are per-sensor and time-windowed — e.g., "alert if temperature > 80°F for 5 consecutive readings" cuts thermal-spike noise.

Anomaly detection compares live readings against per-sensor baselines learned from accumulated observation history, surfacing deviations that fixed thresholds would miss.

Device health checks (battery level, signal strength, last-heartbeat) auto-create maintenance tickets when a sensor goes offline.

Recording modes: continuous, motion-triggered, schedule-driven, event-triggered. Motion regions are drawn directly on the camera preview in admin UI and stored as normalized rectangles.

Storage backends: AWS S3, Cloudflare R2, MinIO (self-hosted), local disk. Customer brings their own bucket and credentials — Sentinel never holds your footage in a multi-tenant vault unless you ask it to.

Retention policies run on a 6-hour cron (off-peak by default). Default 90 days, configurable 7–365 days. Recordings approaching the retention edge can be archived to cold tier (S3 Glacier, R2 Archive) instead of deleted.

Legal hold is a per-recording boolean — when set, the retention cron skips that recording regardless of age. Releases are audit-logged with the actor and reason.

Audit trail captures every retention action — delete, archive, hold, release — to a separate immutable table for SOC2 / ISO27001 evidence.

Sentinel ships an adapter pattern for every hardware-touching service: PTZ control, access-point locking, alarm-panel transport, NVR pipeline. Each service has a typed adapter slot that vendor-specific implementations plug into at runtime.

Honest no-op is the rule: when no adapter is installed, the service returns { enabled: false, reason: "no_*_adapter" } — surfaced in dashboards as a visible gap, never silently succeeded. This prevents the worst class of integration bug ("the UI says door unlocked but the door never moved").

Vendor firmware adapters provide a pluggable framework for Axis, Hikvision, Hanwha, Dahua, and Bosch cameras; the vendor-specific firmware-push protocols (VAPIX / ISAPI / SUNAPI / DSS / RCP) are in progress, so an un-implemented vendor reports an honest "not implemented" rather than silently claiming success. PTZ control adapters cover ONVIF, Pelco-D / Coaxitron, and generic RS-485 serial. Access lock adapters cover HID, Schlage Engage, dormakaba, Salto, Kisi, and generic relay-board.

Swap at runtime — drop in a new vendor adapter without rebooting Sentinel; the slot picks it up via DI on the next call.