Agentic Covenants Matrix

NIST CSF 2.0 · Protect (PR) · 6 concerns × 3 layers

If the agent decides to violate this concern, what stops it at this layer?

Concern	In-agent advisory	Client-side deterministic	Server-side external
IdentityThe agent is distinguishable from any human or other agent.	1 artifactSystem prompt declares "you are an automation agent named X." Identity is carried, not established. Identity claims made in a system prompt have no cryptographic weight; the agent cannot pro…	3 artifactsPer-agent credentials, no shared keys, filesystem ACLs.	7 artifactsDedicated ServiceAccount or IAM principal per agent. OIDC federation. Short-TTL bound tokens.
AuthorizationLeast-privilege scoped access. No wildcards, no inherited operator permissions.	1 artifactModel instructions and scoped tool descriptions.	4 artifactsDeny-by-default tool allowlist, capability-based restriction, PreToolUse hooks, pre-commit hooks.	3 artifactsScoped RBAC Roles, IAM with explicit ARN, Kyverno or OPA admission, namespace scoping.
Blast radiusOne bad action stays contained.	empty by designNo enforcement at this layer; advisory only. Model declines destructive operations — verified failure mode in Kiro, Replit, DataTalks.Club, and Amazon Q (CVE-2025-8217) incidents. Prevention…	4 artifactsSandbox at launch (Seatbelt, bubblewrap, gVisor), seccomp/AppArmor, --network none, read-only mounts, dry-run defaults.	7 artifactsGated IaC apply pipeline, ResourceQuota, NetworkPolicy default-deny, prod/non-prod separation, immutable backups, PDB.
Approval gatingFriction scaled to risk.	1 artifactModel says "are you sure?" Silently bypassable. Anthropic Auto Mode (March 26, 2026): 93% approval rate on permission prompts is the empirical ceiling for human-in-the-loop on top of in-agen…	3 artifactsPreToolUse pattern hooks, tiered config, typed confirmation for tier-3, out-of-band for highest tier, judgment-query escalation.	4 artifactsBranch protection + PR review, CODEOWNERS, multi-party prod approval, plan-and-apply split, deployment freezes.
Supply chainEvery dependency, MCP server, registry, and tool call verified before trusted.	empty by designNo enforcement at this layer; advisory only. Model warns about unvetted packages or unfamiliar MCP servers, frequently wrong about provenance. Prevention lives in client-side and server-side…	4 artifactsMCP server allowlist with hash pinning, Sigstore verification, lockfile pinning, pre-commit deps scan.	5 artifactsOCI signature verification (cosign), SBOM admission, egress NetworkPolicy, OPA attestation policy, MCP domain allowlist at network layer.
Content integrityThe agent is not manipulated by the text it reads, and does not leak through the text it writes.	1 artifactSystem-prompt hardening, instruction hierarchy, and provenance framing of untrusted content with a per-fetch nonce. Advisory, and weaker here than anywhere else in this matrix: prompt inject…	2 artifactsInput scanning before the model sees fetched content, output scanning before a response or tool argument leaves, tool-result sanitization stripping zero-width, bidi, tag-block and ANSI seque…	2 artifactsEgress NetworkPolicy so exfiltration has nowhere to post, DLP at the boundary, and send-side audit written outside the agent's reach. Deliberately the weakest server-side cell in the framewo…

Walk a row left to right and ask one question at each layer: if the agent decides to violate this concern, what stops it here? All three populated is defense in depth. Only the in-agent cell populated is an audit finding, because the model can be talked out of it.