Agentic Covenants / Agentic Sentinels Matrix

Blast radius at Server-side enforcement

This layer is external-and-authoritative.

Falco runtime rules for shells in agent containers and writes to sensitive paths; Cilium Hubble drops; ResourceQuota near-limit Prometheus alert; VPC Flow Log REJECTs.