Skip to content
Michael Rishi Forrester

Agentic Covenants

Agentic Covenants Matrix

If the agent decides to violate this concern, what stops it at this layer?

Filter

All 18

By layer

In-agentClient-side hooksServer-side enforcement

By concern

IdentityAuthorizationBlast radiusApproval gatingSupply chainContent integrity

Layers, by what they can actually enforce

  • In-agent: advisory

    System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.

  • Client-side hooks: deterministic-when-invoked

    Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.

  • Server-side enforcement: deterministic-and-external

    Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.

Showing 6 of 18.

  • Identity at Server-side enforcement

    Dedicated ServiceAccount or IAM principal per agent. OIDC federation. Short-TTL bound tokens.

  • Authorization at Server-side enforcement

    Scoped RBAC Roles, IAM with explicit ARN, Kyverno or OPA admission, namespace scoping.

  • Blast radius at Server-side enforcement

    Gated IaC apply pipeline, ResourceQuota, NetworkPolicy default-deny, prod/non-prod separation, immutable backups, PDB.

  • Approval gating at Server-side enforcement

    Branch protection + PR review, CODEOWNERS, multi-party prod approval, plan-and-apply split, deployment freezes.

  • Supply chain at Server-side enforcement

    OCI signature verification (cosign), SBOM admission, egress NetworkPolicy, OPA attestation policy, MCP domain allowlist at network layer.

  • Content integrity at Server-side enforcement

    Egress NetworkPolicy so exfiltration has nowhere to post, DLP at the boundary, and send-side audit written outside the agent's reach. Deliberately the weakest server-side cell in the framework: it catches the consequence, not the manipulation. The control that actually works is not a content control at all. A scoped credential, deny-by-default RBAC, and default-deny egress make a successful injection worthless, so injection is an authorization and blast-radius problem wearing a content costume.