Skip to content
Michael Rishi Forrester

Agentic Covenants

Agentic Charter Matrix

Who is allowed to put this agent into the world, under what authority, accountable to what policy, with what retirement criteria?

Filter

All 15Agent charterDomain charterOrganizational charterIdentityAuthorizationBlast radiusApproval gatingSupply chain

Layers, by what they can actually enforce

  • Agent charter — advisory

    What the agent's own charter declares. Scope it claims for itself.

  • Domain charter — deterministic-when-invoked

    The domain or team that operates the agent, and the policy they set.

  • Organizational charter — deterministic-and-external

    Authority above the operator. Organizational policy the operator cannot waive.

Showing 5 of 15.

  • Identity at Domain charter

    Domain leadership signs charter authorizing a class of agents. Names roles permitted to create agents and the escalation path.

  • Authorization at Domain charter

    Per-class scope, inherits org hard prohibitions, adds domain-specific restrictions.

  • Blast radius at Domain charter

    Inherits tier taxonomy, defines which tiers the domain is authorized to operate, defines failure-mode reviews per tier.

  • Approval gating at Domain charter

    Domain authority approves charters within its domain. Multi-party signature for Tier 3+. Charter amendments require the same process as originals.

  • Supply chain at Domain charter

    Inherits org-wide approved-model list, adds domain-specific restrictions (e.g., "no models that train on user data", "SOC 2 Type II vendors only"). Approves or denies MCP servers for the domain.