Skip to content
Michael Rishi Forrester

Agentic Covenants

Agentic Covenants Matrix

If the agent decides to violate this concern, what stops it at this layer?

Filter

All 18In-agentClient-side hooksServer-side enforcementIdentityAuthorizationBlast radiusApproval gatingSupply chainContent integrity

Layers, by what they can actually enforce

  • In-agent — advisory

    System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.

  • Client-side hooks — deterministic-when-invoked

    Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.

  • Server-side enforcement — deterministic-and-external

    Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.

Showing 6 of 18.

  • Identity at Server-side enforcement

    Dedicated ServiceAccount or IAM principal per agent. OIDC federation. Short-TTL bound tokens.

  • Authorization at Server-side enforcement

    Scoped RBAC Roles, IAM with explicit ARN, Kyverno or OPA admission, namespace scoping.

  • Blast radius at Server-side enforcement

    Gated IaC apply pipeline, ResourceQuota, NetworkPolicy default-deny, prod/non-prod separation, immutable backups, PDB.

  • Approval gating at Server-side enforcement

    Branch protection + PR review, CODEOWNERS, multi-party prod approval, plan-and-apply split, deployment freezes.

  • Supply chain at Server-side enforcement

    OCI signature verification (cosign), SBOM admission, egress NetworkPolicy, OPA attestation policy, MCP domain allowlist at network layer.

  • Content integrity at Server-side enforcement

    Egress NetworkPolicy so exfiltration has nowhere to post, DLP at the boundary, and send-side audit written outside the agent's reach. Deliberately the weakest server-side cell in the framework: it catches the consequence, not the manipulation. The control that actually works is not a content control at all. A scoped credential, deny-by-default RBAC, and default-deny egress make a successful injection worthless, so injection is an authorization and blast-radius problem wearing a content costume.