Michael Rishi Forrester

Agentic Covenants

Agentic Restorations Matrix

How do I get back to a known-good state and not repeat this?

Filter

All 15 In-agent (empty)Client-side rebuild Server-side restore Identity Authorization Blast radius Approval gating Supply chain

Layers, by what they can actually enforce

In-agent (empty) — none
The agent is the patient, not the surgeon. Empty for recovery.
Client-side rebuild — low-blast-radius
Operator-machine actions. Minutes. Reversible.
Server-side restore — high-blast-radius
Target-system actions. Minutes to hours. The only way to recover from cluster-level compromise.

Showing 3 of 15.

Identity at In-agent (empty)
(no enforcement)
Identity at Client-side rebuild
Regenerate credential file with strict ACLs, rotate OIDC client secret, re-authenticate operator host to SSO, verify ACLs survived.
Identity at Server-side restore
Disable old ServiceAccount, recreate from declarative source, rotate IAM keys, re-establish OIDC trust policy, re-issue SPIFFE identity, verify no inherited permissions.