Agentic Covenants / Agentic Sentinels Matrix

Authorization at Client-side hooks

This layer is deterministic-when-shipped.

Hook decision events (allow/ask/deny/error); auditd watches hook config edits and --no-verify; SIEM rule for multi-deny patterns.