Agentic Covenants

Detect (DE) · Identity

Identity at the in agent layer

advisory · Bypassable by language alone

If this concern is breached, how do we know?

What this cell does

Tool-call logs include credential fingerprint (hash, never raw token); session correlation.

Artifacts (1)

ship-sessions.shview on GitHub
#!/usr/bin/env bash
# ABOUTME: Ships agent session transcripts to a remote sink the agent cannot write to.
# ABOUTME: Run from the operator account via cron or systemd timer; never from the agent's user.

set -euo pipefail

LOCAL_SESSIONS="${LOCAL_SESSIONS:-/home/agent-runner/.claude/sessions}"
REMOTE_SINK="${REMOTE_SINK:-rsync://siem-ingest.example.com/agent-sessions}"
HOST="$(hostname -f)"
LOCK_FILE="/var/lib/agents/.ship-sessions.lock"

# Single-flight lock to prevent overlap on slow runs.
exec 9>"$LOCK_FILE"
if ! flock -n 9; then
  echo "ship-sessions: another run in progress; exiting"
  exit 0
fi

if [[ ! -d "$LOCAL_SESSIONS" ]]; then
  echo "ship-sessions: $LOCAL_SESSIONS does not exist; nothing to ship"
  exit 0
fi

# rsync with --append-verify so a partial transfer can resume.
# --remove-source-files would be a destructive option and is deliberately
# omitted; the sink is authoritative and the local copy is the audit trail.
rsync -av --append-verify \
  --include='*.json' --include='*.jsonl' --include='*.log' \
  --exclude='*' \
  "$LOCAL_SESSIONS/" \
  "${REMOTE_SINK}/${HOST}/"

Cell notes

Sentinels, Identity / In-agent

Control. Tool-call logs include credential fingerprint (hash of token, never the token); session correlation; logs ship to a remote sink.

Strength. Forensic. Useful after the fact, not in real time.

Tooling

  • - Claude Code (or your agent runtime) configured to emit transcript and tool-call logs.
  • - A remote sink the agent's user cannot write to. Without this, the agent edits its own forensic record.

Files in this directory

  • - ship-sessions.sh, cron-style script that tails ~/.claude/sessions/ for new entries and ships them to a remote sink. Run from the operator account, not the agent's.

Verification


# 1. Confirm session shipping
ls -la /var/log/agents/sessions/   # remote sink local mirror
# expected: recent files

Common mistakes

  • - Logs ship to a sink the agent has write access to.
  • - Session correlation drops because the session ID is not propagated through hook events.

Citation

NIST CSF 2.0 DE.CM-09. NIST SP 800-92 (Computer Security Log Management).

Primary failure modes

Documented, not hypothetical. A control whose bypass is undocumented is worse than no control, because somebody trusted it.

  • logs not shipped to a remote sink (agent edits local-only logs)

Crosswalk

NIST CSF 2 0DE.CM-09

Cite this cell: https://agenticcovenants.com/detect/identity/in-agent/