Intent drift: when a control passes audit and fails its purpose
AI agents can scale obsolete policy with great efficiency. Review must ask whether the control still reduces the risk that justified its creation.
- Nature
- Governance and control-design analysis
- Trigger
- 23 July 2026 ISACA article, cross-checked with NIST and OECD
- Scope
- Automated controls and AI agents in production
- Limit
- The example does not presume failure in any named sector or organisation
In brief
ISACA describes intent drift as the gradual separation between a control's original reason and the current environment. NIST calls for periodic review of risk processes, production systems, and stated purpose. For agents executing thousands of decisions, configuration evidence needs outcome evidence: target risk, current threat, observed result, and a retirement threshold.
- Add purpose, threat, hypothesis, metric, and review date to every control — alongside owner and execution evidence.
- Test false negatives and adverse effects; compliance rate only says the mechanism ran.
- Trigger review when model, tools, data, users, law, or threat changes materially.
- Allow controls that no longer reduce risk to be retired without erasing decision history.
Execution compliance is not control effectiveness
A control has at least two questions: did it run as designed, and does it still reduce the intended risk? Logs, tickets, and signatures answer the first. The second requires observing threats, outcomes, bypasses, cost, and service impact.
Agents amplify the problem because they apply an old decision faster and at greater scale. NIST recommends post-deployment monitoring, periodic review, override, change management, and safe decommissioning. Purpose review is not an audit exception; it is lifecycle work.
Cycle against drift
- DESIGNExplicit hypothesis
Which risk is reduced, for whom, and under which assumptions?
- EXECUTIONTechnical proof
Did the mechanism run, decide, and record as intended?
- EFFECTObserved outcome
Do incidents, bypasses, and cost confirm risk reduction?
- REVIEWKeep, change, or retire
The decision has an owner, evidence, and deadline.
A control record should preserve intent and invalidation signals
Bind every agent rule to a risk and human decision. Retain model, tools, data, threshold, users, and authority present when the hypothesis was approved. Then define reopening signals: rising exceptions, a new adversarial technique, process change, or disproportionate impact.
Do not let the agent be its only evaluator. Independent sampling, adversarial tests, affected-person feedback, and incident analysis reduce the chance that the same flaw validates itself.
Effectiveness record
| Field | Question | Metric | Trigger |
|---|---|---|---|
| Purpose | Which risk is reduced? | Risk outcome | Objective changes |
| Hypothesis | What must stay true? | External indicator | Assumption breaks |
| Execution | Does the rule run? | Coverage/errors | Technical failure |
| Effect | Does harm fall? | Incidents/bypasses | Effectiveness drops |
| Cost | Does it create side effects? | Delay/resources | Disproportion |
Start with controls that have the greatest scale and least observability
Choose ten automated controls that block, approve, or execute the most operations. Ask for the latest outcome evidence and the event that reopens each. No answer is a governance finding, not permission to invent a KPI.
Put review into change management and link it to agent changes. A new prompt, added tool, or wider autonomy should revalidate dependent controls even when the written policy did not change.
- Do not measure effectiveness only through compliant execution percentage.
- Do not renew a control by inertia or because no known incident occurred.
- Do not let unexpired exceptions create an invisible new normal.
- Do not retire a control without retaining rationale, evidence, and residual risk.
Sources consulted
Consulted on the stated update date.
Opens in a new window.Participate
Share the analysis. Add context.
Distribute the article through your channel or leave an observation connected to the topic.
Comments
Loading the conversation.