Skip to content
Michael Rishi Forrester

Agentic Covenants

Agentic Covenants Matrix

If the agent decides to violate this concern, what stops it at this layer?

Filter

All 18

By layer

In-agentClient-side hooksServer-side enforcement

By concern

IdentityAuthorizationBlast radiusApproval gatingSupply chainContent integrity

Layers, by what they can actually enforce

  • In-agent: advisory

    System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.

  • Client-side hooks: deterministic-when-invoked

    Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.

  • Server-side enforcement: deterministic-and-external

    Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.

Showing 6 of 18.

  • Identity at In-agent

    System prompt declares "you are an automation agent named X." Identity is carried, not established. Identity claims made in a system prompt have no cryptographic weight; the agent cannot prove its own identity to the target. Advisory only.

  • Authorization at In-agent

    Model instructions and scoped tool descriptions.

  • Blast radius at In-agent

    No enforcement at this layer; advisory only. Model declines destructive operations — verified failure mode in Kiro, Replit, DataTalks.Club, and Amazon Q (CVE-2025-8217) incidents. Prevention lives in client-side and server-side.

  • Approval gating at In-agent

    Model says "are you sure?" Silently bypassable. Anthropic Auto Mode (March 26, 2026): 93% approval rate on permission prompts is the empirical ceiling for human-in-the-loop on top of in-agent gates. Treat any approval prompt that fires often as already broken.

  • Supply chain at In-agent

    No enforcement at this layer; advisory only. Model warns about unvetted packages or unfamiliar MCP servers, frequently wrong about provenance. Prevention lives in client-side and server-side.

  • Content integrity at In-agent

    System-prompt hardening, instruction hierarchy, and provenance framing of untrusted content with a per-fetch nonce. Advisory, and weaker here than anywhere else in this matrix: prompt injection is an attack aimed precisely at this layer, so it is the one surface an adversary directly optimizes against. Reduces low-effort attacks so downstream scanners have less to score. Never cite it as a mitigation in a risk register.