The Agentic Control Matrix

Every tool the agent can call is listed, with its scope, whether it writes, and what an attacker gains by calling it. A tool nobody documented is a permission nobody reviewed.

Why this quadrant: It constrains what may exist before anything runs, but nothing enforces its completeness: a catalogue is worth the diligence of whoever wrote it.

Each tool holds its own credential, issued at the narrowest scope the upstream system supports. A read-only tool backed by an admin token is one bug away from being a write tool.

Why this quadrant: The scope is enforced upstream, on the input side: a call outside it fails the same way every time, whatever the model intended.

The targets a tool may address — paths, repositories, tables, accounts, recipients — are constrained server-side, so a hijacked agent cannot repoint a legitimate tool at an illegitimate target.

Why this quadrant: It inspects the argument before the call happens, and refuses by rule rather than by opinion.

Outbound traffic reaches only named destinations; everything else is refused. Every exfiltration path ends in an outbound request, so this is the control that still works after the model has been convinced.

Why this quadrant: The destination is checked before the request leaves; no outcome is measured and no judgement is involved.

Refused outbound requests are logged as security signal and reach a human. A denial is one of the few unambiguous attack signals an agent stack produces, and it is worthless if it lands in the same bucket as a timeout.

Why this quadrant: It acts on something that already happened — a refusal — and it fires by rule, on every one of them.

An agent endpoint reachable from outside validates its transport before doing work: origin checked against an allowlist, browser-initiated cross-site calls rejected, and every caller rate limited with a real 429.

Why this quadrant: The request is judged by its Origin header before any handler runs; the same call gets the same answer every time.

Anything the agent generates or invokes runs in an environment created per task and destroyed after, holding no ambient credentials. Persistence is how a one-off compromise becomes a foothold.

Why this quadrant: The environment is built without the credentials before the task starts; there is nothing to measure and nothing to decide.

CPU, memory, disk, wall-clock and call count are bounded by the host. Runaway consumption is the failure mode that arrives first and most often, usually with no adversary involved at all.

Why this quadrant: A cap is a feedback loop in the strict sense: it measures consumption as it happens and acts when a threshold is crossed.

Every action the agent can take is either reversible or gated, and a person can stop the agent mid-run without stopping the whole system. Autonomy without an off switch is not autonomy, it is exposure.

Why this quadrant: Somebody has to be watching and decide that this run should end; the mechanism is deterministic, the trigger is not.

Actions that are irreversible, regulated or expensive stop for a person who can approve, edit or reject, with enough context to decide. Gate by risk, not by default — over-gating produces rubber-stamping, which is worse than no gate because it looks like one.

Why this quadrant: It stops the action before it happens, but what it stops for is a person's decision, and the same case can be decided two ways.

When the agent is uncertain, blocked or out of policy, there is a defined path to a person, and that person is named. An escalation route with no owner is a queue.

Why this quadrant: It triggers on a state the run has already reached — uncertain, blocked, out of policy — and what happens next is a judgement.

Each run produces an immutable, correlated record: inputs, model and version, tool calls with arguments and outcomes, and the final action. Enough to reconstruct what happened, and nothing that turns the log itself into the breach.

Why this quadrant: Pure measurement after the fact: it changes nothing about the run it records, and it records by rule.

A curated set of cases runs on every change, and a regression blocks release. Without it, 'it seems to work' is the entire quality argument, and nothing distinguishes a fix from a change.

Why this quadrant: It measures outputs the system already produced, and what counts as a regression in agentic output is a judgement — the suite covers whichever cases someone chose.

Retrieved documents, tool results and third-party output are delimited as data, never merged into the instruction channel. The model cannot reliably tell them apart, so the harness must.

Why this quadrant: The delimiting happens on the input, before the model reads it, and it applies to every document without asking what is inside.

Anything the model emits that reaches a renderer, a shell, a query or another system is encoded and validated exactly as input from a stranger would be.

Why this quadrant: The moment is relative to the action being protected: the encoding acts on the sink's input, before the sink does anything with it.

What the agent writes to persistent memory is attributed, reviewable and expirable. Memory is what turns a one-shot attack into one that re-triggers on future, unrelated tasks.

Why this quadrant: Its teeth close on what was already written, and deciding that a stored fact is false is a judgement no rule makes for you.

Models, system prompts, MCP servers, packages and datasets are pinned, reviewed on change, and traceable to a source. A dependency that can rewrite a tool description can rewrite the agent's behaviour.

Why this quadrant: A pin is checked before the dependency is used, and a tool description that changed is a diff, not an opinion.

The attack surfaces are written down with a control and an owner each, accepted risks are named as accepted, and the document is revisited whenever a tool, a data source or an autonomy level changes.

Why this quadrant: Its test compares two dates, but what the document says is judgement, and it is revised in response to changes that already landed.