Agentic Covenants / Agentic Inventory Matrix
Identity at Discovered
This layer is deterministic-and-external.
CloudTrail / GCP Audit Logs of SA and IAM principal usage. K8s controller watching SA+RoleBinding by naming pattern. Reverse-lookup from credential fingerprints in Sentinels.
Maps to
- NIST CSF 2.0
- ID.AM-01, ID.AM-02
- NIST AI RMF
- MAP 1.1, MAP 1.5
- csa_maestro
- Layer 4, Layer 7
- Other
- NIST SP 800-92 (log management), NIST AI Agent Standards Initiative under CAISI (Feb 17, 2026)