A capability matrix for agent security hooks that separates visibility, evidence quality, activation, failure behavior, and enforcement.