Skip to content
Michael Rishi Forrester

Agentic Covenants

Agentic Covenants Matrix

If the agent decides to violate this concern, what stops it at this layer?

Filter

All 18In-agentClient-side hooksServer-side enforcementIdentityAuthorizationBlast radiusApproval gatingSupply chainContent integrity

Layers, by what they can actually enforce

  • In-agent — advisory

    System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.

  • Client-side hooks — deterministic-when-invoked

    Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.

  • Server-side enforcement — deterministic-and-external

    Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.

Showing 3 of 18.

  • Identity at In-agent

    System prompt declares "you are an automation agent named X." Identity is carried, not established. Identity claims made in a system prompt have no cryptographic weight; the agent cannot prove its own identity to the target. Advisory only.

  • Identity at Client-side hooks

    Per-agent credentials, no shared keys, filesystem ACLs.

  • Identity at Server-side enforcement

    Dedicated ServiceAccount or IAM principal per agent. OIDC federation. Short-TTL bound tokens.