Skip to content
Michael Rishi Forrester

Agentic Covenants

Agentic Covenants Matrix

If the agent decides to violate this concern, what stops it at this layer?

Filter

All 18In-agentClient-side hooksServer-side enforcementIdentityAuthorizationBlast radiusApproval gatingSupply chainContent integrity

Layers, by what they can actually enforce

  • In-agent — advisory

    System prompts, model training, tool descriptions, refusals. No homeostatic stake, no pre-action pause, no learning loop. Treat as nudge, not control.

  • Client-side hooks — deterministic-when-invoked

    Operator-machine or agent-execution context. Strong against language attacks. Weak against an agent with shell access and time.

  • Server-side enforcement — deterministic-and-external

    Runs on the target system, not on the agent. Bypass requires compromise, policy gaps, or operator manipulation.

Showing 6 of 18.

  • Identity at In-agent

    System prompt declares "you are an automation agent named X." Identity is carried, not established. Identity claims made in a system prompt have no cryptographic weight; the agent cannot prove its own identity to the target. Advisory only.

  • Authorization at In-agent

    Model instructions and scoped tool descriptions.

  • Blast radius at In-agent

    No enforcement at this layer; advisory only. Model declines destructive operations — verified failure mode in Kiro, Replit, DataTalks.Club, and Amazon Q (CVE-2025-8217) incidents. Prevention lives in client-side and server-side.

  • Approval gating at In-agent

    Model says "are you sure?" Silently bypassable. Anthropic Auto Mode (March 26, 2026): 93% approval rate on permission prompts is the empirical ceiling for human-in-the-loop on top of in-agent gates. Treat any approval prompt that fires often as already broken.

  • Supply chain at In-agent

    No enforcement at this layer; advisory only. Model warns about unvetted packages or unfamiliar MCP servers, frequently wrong about provenance. Prevention lives in client-side and server-side.

  • Content integrity at In-agent

    System-prompt hardening, instruction hierarchy, and provenance framing of untrusted content with a per-fetch nonce. Advisory, and weaker here than anywhere else in this matrix: prompt injection is an attack aimed precisely at this layer, so it is the one surface an adversary directly optimizes against. Reduces low-effort attacks so downstream scanners have less to score. Never cite it as a mitigation in a risk register.