Is privilege escalation a defect, or is it the function?
Level says how much can be fixed at design time. Mandate says whether run-time detection is available at all. Reach says what it costs when both fail.
Three mandates, one question
| Mandate | The agent is authorized to | Escalation is | Behavioral detection |
|---|---|---|---|
| Observational | Learn and report. Any state change is out of mandate. | A defect, and unambiguous | Strongest — any write is an alarm |
| Operational | Change specified state within a defined function | A defect | Strong — escalation-shaped activity is an alarm |
| Adversarial | Defeat controls, in order to demonstrate that they can be defeated | The function | Unavailable |
↔ scroll table
Adversarial agents are expected to escalate. Privilege escalation, credential harvesting, lateral movement, control evasion, and persistence are the deliverable, not the failure. The agent escalates constantly and correctly, so anomaly detection cannot separate authorized escalation from a breakout. Containment must be structural: enforced by network position and identity scope regardless of what the agent does, because there is no behavioral signature to key on.
Structural containment is more expensive than detection. Adversarial mandate is therefore an expensive mandate, and should be granted deliberately and narrowly.
Operational and adversarial are incomparable
Observational is contained by operational. But a penetration testing agent is authorized to harvest credentials and move laterally, and typically not to make production business-state writes. An operational deployment agent is the reverse. Neither is a superset of the other.
Treat mandate as a partial order with observational at the bottom and two independent branches above it. A total ordering would license an adversarial parent to mint an operational child and silently drop it out of structural containment.
The pairings are free
An L2 scripted vulnerability scan is adversarial at L2. An L5 orchestrator producing market research is observational at L5.
Do not assume offensive means autonomous, or that autonomous means offensive.
Response agents
SOC containment, auto-remediation, and incident response automation carry an operational mandate: escalation is still a defect. But their authorized actions (isolate a host, disable an account, kill sessions, block at the perimeter) have adversarial-grade blast radius, and they hold credentials with adversarial-grade breadth in order to perform them.
Classify them operational. Expect their measured reach to come back R2 or R3. Do not assign R3 by fiat as a rigor dial; measure it, and it will usually be R3 anyway.
What it costs when containment fails
Reach is a property of what the agent can touch, not what it intends to touch. It is measured by network and identity position, not by the prompt.
Isolated
Synthetic or copied data, ephemeral resources, no route to production, systems of record, or third parties.
Internal non-production
Real internal systems, no production data, no customer-visible effect.
Production, internal
Production systems and data. Consequences confined to the organization.
External
Third-party, customer-facing, regulated, shared-tenancy, safety-relevant, or partner-connected. Includes anything where a mistake creates a notification obligation.
An agent on a developer workstation with an active VPN session has R2 or R3 reach regardless of its assignment, because reach is measured by the network and identity position, not the prompt. This is the test that most cleanly separates asserted containment from real containment.
Build a profile
Every agent gets one: Level / Mandate / Reach. Control rigor is a function of all three. Pick a combination to see the posture CUSTODY assigns it.
This is a reading aid, not the control matrix. The specification's annex carries the full matrix.
Cells to govern explicitly
| Profile | Posture |
|---|---|
| L1–L2 / Observational or Operational / R0–R1 | Low ceremony. Do not over-govern this. It is most of the fleet and the controls should be cheap. |
| L3–L4 / Operational / R2 | The volume case. Most agents, most incidents, most of the exposure. Full pillar coverage at maturity 2 is the target. |
| Any / Adversarial / R3 | Per-target legal authorization, no exceptions. Structural containment only. |
| L5–L6 / Adversarial / any | Formal program with named executive owner, standing legal authorization, and continuous supervision. |
| L6 / Adversarial / R2 or R3 | Prohibited by default. Nothing is fixed at design time and no behavioral signal is available. Requires a documented exception at the risk-owner level, or do not run it. |
| L4 and above / any / R3 | Synchronous human approval for every irreversible action. |
↔ scroll table
No agent's granted authority may exceed the authority of the human who authorized it. This is violated constantly and quietly: agents receive service accounts more powerful than any individual on the owning team, because the account was scoped to the tool rather than to the authorizer.