Agentic Sentinels Matrix

NIST CSF 2.0 · Detect (DE) · 5 concerns × 3 layers

If this concern is breached, how do we know?

Concern	In-agent advisory	Client-side deterministic	Server-side external
IdentityIdentity used outside expected hours, source IP, or by an unexpected principal.	1 artifactTool-call logs include credential fingerprint (hash, never raw token); session correlation.	3 artifactsPreToolUse hook emits structured identity events; auditd watches agent process startup; Vector/Fluent Bit ships to SIEM.	4 artifactsK8s audit log captures every agent SA action; CloudTrail with Object Lock; SIEM rules on out-of-hours, unexpected source IP, identity reuse.
AuthorizationHook denial events, RBAC denials, IAM Access Analyzer findings, OPA decision logs.	0 artifactsTool descriptions logged with each call (forensic).	3 artifactsHook decision events (allow/ask/deny/error); auditd watches hook config edits and --no-verify; SIEM rule for multi-deny patterns.	4 artifactsRBAC denial events from K8s audit; IAM Access Analyzer findings; Kyverno PolicyReports; OPA decision logs centralized.
Blast radiusSandbox boundary events, network attempts on --network none agents, NetworkPolicy denials, ResourceQuota near-limit alerts, VPC Flow Log REJECTs.	1 artifactReasoning trace and tool-call log capture for forensics, plus a lethal-trifecta detector at the wrapper layer that flags when private data, untrusted content, and external communication appe…	3 artifactsbpftrace or Falco userspace catches unsandboxed children, sandbox EPERM events, unexpected network attempts; correlates by session ID.	4 artifactsFalco runtime rules for shells in agent containers and writes to sensitive paths; Cilium Hubble drops; ResourceQuota near-limit Prometheus alert; VPC Flow Log REJECTs.
Approval gatingHook decision-log timing analysis (alert fatigue), branch-protection bypass events, deployment-freeze breach attempts.	0 artifactsConfirmation-prompt usage forensically logged.	3 artifactsApproval-timing analysis surfaces alert-fatigue (response under 2s across more than 50 approvals); typed-confirmation mismatch events; out-of-band channel decisions joined to session.	3 artifactsGitHub webhook for branch-protection bypass; hourly drift-detection job; deployment-freeze breach alerts; audit on changes to branch protection itself.
Supply chainMCP allowlist violations, lockfile diff, tool-description hash mismatch, image-pull events with signature status, SBOM diff, cosign verification failures.	0 artifacts"Where did this dependency come from" forensically traceable through tool-call log.	3 artifactsMCP allowlist violation events; tool-description hash mismatch alerting; lockfile diff in CI logs centralized; pre-commit dependency scan results.	4 artifactsImage-pull events with signature verification status; SBOM diff over time per workload; cosign verification failures; egress NetworkPolicy denials to non-allowlisted MCP domains.

Walk a row left to right and ask one question at each layer: if the agent decides to violate this concern, what stops it here? All three populated is defense in depth. Only the in-agent cell populated is an audit finding, because the model can be talked out of it.