Agentic Covenants Matrix
If the agent decides to violate this concern, what stops it at this layer?
Filter
Layers, by what they can actually enforce
- In-agent: advisory
System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.
- Client-side hooks: deterministic-when-invoked
Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.
- Server-side enforcement: deterministic-and-external
Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.
Showing 18 of 18.
Identity at In-agent
System prompt declares "you are an automation agent named X." Identity is carried, not established. Identity claims made in a system prompt have no cryptographic weight; the agent cannot prove its own identity to the target. Advisory only.
Identity at Client-side hooks
Per-agent credentials, no shared keys, filesystem ACLs.
Identity at Server-side enforcement
Dedicated ServiceAccount or IAM principal per agent. OIDC federation. Short-TTL bound tokens.
Authorization at In-agent
Model instructions and scoped tool descriptions.
Authorization at Client-side hooks
Deny-by-default tool allowlist, capability-based restriction, PreToolUse hooks, pre-commit hooks.
Authorization at Server-side enforcement
Scoped RBAC Roles, IAM with explicit ARN, Kyverno or OPA admission, namespace scoping.
Blast radius at In-agent
No enforcement at this layer; advisory only. Model declines destructive operations — verified failure mode in Kiro, Replit, DataTalks.Club, and Amazon Q (CVE-2025-8217) incidents. Prevention lives in client-side and server-side.
Blast radius at Client-side hooks
Sandbox at launch (Seatbelt, bubblewrap, gVisor), seccomp/AppArmor, --network none, read-only mounts, dry-run defaults.
Blast radius at Server-side enforcement
Gated IaC apply pipeline, ResourceQuota, NetworkPolicy default-deny, prod/non-prod separation, immutable backups, PDB.
Approval gating at In-agent
Model says "are you sure?" Silently bypassable. Anthropic Auto Mode (March 26, 2026): 93% approval rate on permission prompts is the empirical ceiling for human-in-the-loop on top of in-agent gates. Treat any approval prompt that fires often as already broken.
Approval gating at Client-side hooks
PreToolUse pattern hooks, tiered config, typed confirmation for tier-3, out-of-band for highest tier, judgment-query escalation.
Approval gating at Server-side enforcement
Branch protection + PR review, CODEOWNERS, multi-party prod approval, plan-and-apply split, deployment freezes.
Supply chain at In-agent
No enforcement at this layer; advisory only. Model warns about unvetted packages or unfamiliar MCP servers, frequently wrong about provenance. Prevention lives in client-side and server-side.
Supply chain at Client-side hooks
MCP server allowlist with hash pinning, Sigstore verification, lockfile pinning, pre-commit deps scan.
Supply chain at Server-side enforcement
OCI signature verification (cosign), SBOM admission, egress NetworkPolicy, OPA attestation policy, MCP domain allowlist at network layer.
Content integrity at In-agent
System-prompt hardening, instruction hierarchy, and provenance framing of untrusted content with a per-fetch nonce. Advisory, and weaker here than anywhere else in this matrix: prompt injection is an attack aimed precisely at this layer, so it is the one surface an adversary directly optimizes against. Reduces low-effort attacks so downstream scanners have less to score. Never cite it as a mitigation in a risk register.
Content integrity at Client-side hooks
Input scanning before the model sees fetched content, output scanning before a response or tool argument leaves, tool-result sanitization stripping zero-width, bidi, tag-block and ANSI sequences plus the wrapping nonce. Probabilistic: these score and threshold, so false positives and false negatives are inherent. Never block on input scores, which is how a control gets switched off next quarter; block on output, where a false positive costs a retry and a false negative costs a secret.
Content integrity at Server-side enforcement
Egress NetworkPolicy so exfiltration has nowhere to post, DLP at the boundary, and send-side audit written outside the agent's reach. Deliberately the weakest server-side cell in the framework: it catches the consequence, not the manipulation. The control that actually works is not a content control at all. A scoped credential, deny-by-default RBAC, and default-deny egress make a successful injection worthless, so injection is an authorization and blast-radius problem wearing a content costume.