Agentic Covenants / Agentic Sentinels Matrix
Identity at Client-side hooks
This layer is deterministic-when-shipped.
PreToolUse hook emits structured identity events; auditd watches agent process startup; Vector/Fluent Bit ships to SIEM.
Maps to
- NIST CSF 2.0
- DE.CM-01, DE.CM-09
- Other
- NIST SP 800-92, NIST NCCoE Concept Paper on AI Agent Identity (Feb 5, 2026)