Agentic Covenants / Agentic Sentinels Matrix
Blast radius at Client-side hooks
This layer is deterministic-when-shipped.
bpftrace or Falco userspace catches unsandboxed children, sandbox EPERM events, unexpected network attempts; correlates by session ID.
Maps to
- NIST CSF 2.0
- DE.CM-01, DE.CM-09
- Other
- NIST SP 800-160 Vol. 1