Agentic Covenants Matrix
If the agent decides to violate this concern, what stops it at this layer?
Filter
Layers, by what they can actually enforce
- In-agent: advisory
System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.
- Client-side hooks: deterministic-when-invoked
Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.
- Server-side enforcement: deterministic-and-external
Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.
Showing 3 of 18.
Identity at In-agent
System prompt declares "you are an automation agent named X." Identity is carried, not established. Identity claims made in a system prompt have no cryptographic weight; the agent cannot prove its own identity to the target. Advisory only.
Identity at Client-side hooks
Per-agent credentials, no shared keys, filesystem ACLs.
Identity at Server-side enforcement
Dedicated ServiceAccount or IAM principal per agent. OIDC federation. Short-TTL bound tokens.