Agentic Covenants / Agentic Interventions Matrix
Authorization at Server-side cutoffs
This layer is authoritative.
Apply emergency Kyverno deny-all, replace agent Role with empty rules, attach IAM deny-all, Git pre-receive reject.
Maps to
- NIST CSF 2.0
- RS.MI-01, RS.MI-02, PR.AA-05
- NIST AI RMF
- MANAGE 4.1
- OWASP Agentic
- ASI02, ASI03, ASI05
- Other
- NIST SP 800-207