Agentic Covenants Matrix
If the agent decides to violate this concern, what stops it at this layer?
Filter
Layers, by what they can actually enforce
- In-agent: advisory
System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.
- Client-side hooks: deterministic-when-invoked
Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.
- Server-side enforcement: deterministic-and-external
Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.
Showing 3 of 18.
Approval gating at In-agent
Model says "are you sure?" Silently bypassable. Anthropic Auto Mode (March 26, 2026): 93% approval rate on permission prompts is the empirical ceiling for human-in-the-loop on top of in-agent gates. Treat any approval prompt that fires often as already broken.
Approval gating at Client-side hooks
PreToolUse pattern hooks, tiered config, typed confirmation for tier-3, out-of-band for highest tier, judgment-query escalation.
Approval gating at Server-side enforcement
Branch protection + PR review, CODEOWNERS, multi-party prod approval, plan-and-apply split, deployment freezes.