Agentic Sentinels Matrix

If this concern is breached, how do we know?

Filter

All 15 In-agent (forensic only)Client-side hooks Server-side enforcement Identity Authorization Blast radius Approval gating Supply chain

Layers, by what they can actually enforce

In-agent (forensic only) — forensic
Transcript and tool-call logs from the agent runtime. Forensic value, not real-time. Lethal-trifecta detector at the wrapper layer is the only L1 with detection value.
Client-side hooks — deterministic-when-shipped
auditd, eBPF, hook decision logs, MCP allowlist violation logs. Tamper-evident only if logs ship to a remote sink owned by the operator, not the agent.
Server-side enforcement — external-and-authoritative
Kubernetes audit logs, CloudTrail, Falco, Hubble, Kyverno PolicyReports, GitHub webhooks. External to the agent's compromise model.

Showing 15 of 15.

Identity at In-agent (forensic only)
Tool-call logs include credential fingerprint (hash, never raw token); session correlation.
Identity at Client-side hooks
PreToolUse hook emits structured identity events; auditd watches agent process startup; Vector/Fluent Bit ships to SIEM.
Identity at Server-side enforcement
K8s audit log captures every agent SA action; CloudTrail with Object Lock; SIEM rules on out-of-hours, unexpected source IP, identity reuse.
Authorization at In-agent (forensic only)
Tool descriptions logged with each call (forensic).
Authorization at Client-side hooks
Hook decision events (allow/ask/deny/error); auditd watches hook config edits and --no-verify; SIEM rule for multi-deny patterns.
Authorization at Server-side enforcement
RBAC denial events from K8s audit; IAM Access Analyzer findings; Kyverno PolicyReports; OPA decision logs centralized.
Blast radius at In-agent (forensic only)
Reasoning trace and tool-call log capture for forensics, plus a lethal-trifecta detector at the wrapper layer that flags when private data, untrusted content, and external communication appear in the same context window. The detector is the only L1 control with real-time detection value, and it runs outside the agent.
Blast radius at Client-side hooks
bpftrace or Falco userspace catches unsandboxed children, sandbox EPERM events, unexpected network attempts; correlates by session ID.
Blast radius at Server-side enforcement
Falco runtime rules for shells in agent containers and writes to sensitive paths; Cilium Hubble drops; ResourceQuota near-limit Prometheus alert; VPC Flow Log REJECTs.
Approval gating at In-agent (forensic only)
Confirmation-prompt usage forensically logged.
Approval gating at Client-side hooks
Approval-timing analysis surfaces alert-fatigue (response under 2s across more than 50 approvals); typed-confirmation mismatch events; out-of-band channel decisions joined to session.
Approval gating at Server-side enforcement
GitHub webhook for branch-protection bypass; hourly drift-detection job; deployment-freeze breach alerts; audit on changes to branch protection itself.
Supply chain at In-agent (forensic only)
"Where did this dependency come from" forensically traceable through tool-call log.
Supply chain at Client-side hooks
MCP allowlist violation events; tool-description hash mismatch alerting; lockfile diff in CI logs centralized; pre-commit dependency scan results.
Supply chain at Server-side enforcement
Image-pull events with signature verification status; SBOM diff over time per workload; cosign verification failures; egress NetworkPolicy denials to non-allowlisted MCP domains.