Skip to content
Michael Rishi Forrester

Agentic Covenants

Agentic Inventory Matrix

What agents exist, what they touch, what threats they face?

Filter

All 15Self-declaredOperator-declaredDiscoveredIdentityAuthorizationBlast radiusApproval gatingSupply chain

Layers, by what they can actually enforce

  • Self-declared — advisory

    The agent reports itself. It can be wrong, stale, or absent entirely.

  • Operator-declared — deterministic-when-invoked

    The operator registered it. Accurate only as far as the operator knows.

  • Discovered — deterministic-and-external

    Found independently by scanning the target. Trusts neither of the above.

Showing 5 of 15.

  • Identity at Self-declared

    Agent registers on startup with name, charter ref, owner email, instance ID. Heartbeats. Deregister on shutdown. Dead-mans-switch alerts on heartbeat lapse.

  • Authorization at Self-declared

    Agent reports allowed-tools list, MCP allowlist hashes, effective scope on registration. Updates on scope change.

  • Blast radius at Self-declared

    Agent reports declared risk tier, damage cap, forbidden operations from its charter. Reports current environment and data class access.

  • Approval gating at Self-declared

    Agent reports last charter signature date, next review due, current charter version on registration. Refuses to start if charter is expired.

  • Supply chain at Self-declared

    Agent reports current dependency manifest on registration: foundation model + version, MCP server names + hashes, base image SHA, lockfile fingerprint. Updates on change.