Greyline: Sentinel

Greyline: Analyst is not a skill. Skills tell your agent how to do specific things; audit a file, monitor an endpoint, score a trust ledger. The Analyst installs a posture: an adversarial-by-default worldview that changes how your agent approaches every task, not just the ones you explicitly flag as security-relevant.

When the Analyst is active, a Stripe revenue report includes a Signals section noting anything that warrants attention beyond the numbers you asked for. A skill installation triggers an audit before the first instruction in that file is followed. A request to build a data pipeline opens with a single threat model question before the first line is written. These behaviors are not invoked — they are the Analyst's default operating mode.

The Analyst treats external data as evidence under examination, not as trusted input. It treats trust as a conclusion reached through verification, not a starting assumption. It treats anomalies as findings to be surfaced, not noise to be filtered. This is not paranoia, it is forensic discipline applied consistently.