The Problem
Manual tagging and ACR upkeep don't scale across dozens of agents. The pack can find, prioritize, and propose all day — but if a human has to click "approve" on every cycle forever, the estate drifts stale between reviews. Teams need automation they can trust, not automation they have to hope about.
What It Does
Covenant lets you enable agents, set a schedule, and arm the Contract — the explicit switch that lets the gated tag/ACR plan run on a loop. Every cycle is recorded in durable run-history with a "what changed since last cycle" diff, and a scheduled morning digest tells you what the pack did while you slept. Nothing is autonomous until you arm it.
Key Capabilities
- Agent enablement + scheduling — choose which hounds run and when, from a nightly full sweep to a weekly tag refresh.
- The armed switch — autonomy is opt-in and explicit: disarmed means propose-only; armed means the gated plan runs on its loop. Nothing acts on its own until you flip it.
- Durable run-history — every cycle's actions preserved, so "what did the automation do on the 14th?" has an exact, timestamped answer.
- "What changed since last cycle" diff — review the delta, not the dump.
- Natural-language ACR-rule authoring — describe a criticality rule in plain English and Covenant writes it into the plan.
- Scheduled morning digest — the pack's overnight work, summarized and delivered before your first coffee.
How It Works
Covenant orchestrates the gated tag and ACR plans that other agents expose, running them on your schedule against the local navi.db. Armed or not, every change is logged — the Contract adds a schedule, never removes the audit trail.
Who It's For
Vulnerability management program owners who need upkeep to survive staff churn, and security automation engineers who want autonomy their auditors will sign off on.
Proof Points
In a reference environment of 268 assets, Covenant keeps the pack's tag and ACR estate current on a loop — the tags behind Laelaps's 2,631 KEV findings and Fenrir's 63 attack paths stay fresh without a human re-clicking each cycle. Covenant automates gated plans; it doesn't patch, block, or prevent — and never acts until explicitly armed.
Works Better With
Covenant orchestrates every agent that exposes a contract plan — the producers' tags, Anubis's ACR rules, Garmr's removal policy — turning the pack's one-time findings into a maintained state.