Sentinel-RL keeps the LLM out of anything larger than its context window.

A heterogeneous graph attention encoder compresses a live authentication subgraph into a fixed state, a PPO policy maps that to constrained investigative actions, and the LLM only consumes recommendations and writes analyst-readable narratives behind a critic gate. On LANL's cyber-security events data, a two-phase CREATE ingestion loads 24M edges into Neo4j in 14.2 minutes on one 32-core node, about 24x faster than the canonical MERGE pipeline. PPO converges to 0.91 held-out precision and 0.87 recall, full loop median 6.3 seconds. The architecture generalizes past security. arXiv 2609.04159