Agentic Covenants Matrix
If the agent decides to violate this concern, what stops it at this layer?
Filter
Layers, by what they can actually enforce
- In-agent: advisory
System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.
- Client-side hooks: deterministic-when-invoked
Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.
- Server-side enforcement: deterministic-and-external
Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.
Showing 3 of 18.
Blast radius at In-agent
No enforcement at this layer; advisory only. Model declines destructive operations — verified failure mode in Kiro, Replit, DataTalks.Club, and Amazon Q (CVE-2025-8217) incidents. Prevention lives in client-side and server-side.
Blast radius at Client-side hooks
Sandbox at launch (Seatbelt, bubblewrap, gVisor), seccomp/AppArmor, --network none, read-only mounts, dry-run defaults.
Blast radius at Server-side enforcement
Gated IaC apply pipeline, ResourceQuota, NetworkPolicy default-deny, prod/non-prod separation, immutable backups, PDB.