Agentic Shadow Infrastructure: How AI Supply-Chain Drift Creates Unmanaged Enterprise Infrastructure

Campbell, Robert

doi:10.3390/computers15080510

Abstract

Agent identity governance governs an agent’s identity, credentials, and lifecycle, but assumes the composition it was approved with is the composition it runs with. That stability assumption is unenforced: no lifecycle mechanism evaluates an agent’s evolving composition against its approved baseline. An agent’s effective composition—tools, data sources, delegated authorities, child agents—is a runtime supply chain of capability, and it drifts. We introduce composition drift, the departure of effective composition from the terms of approval, and isolate its sharpest form, compositional drift: individually approved changes accumulating into a capability none authorized alone. We formalize this with a two-stage operator: a component diff detects that the composition changed; a capability-closure stage detects when it authorized something new. The contribution is a temporal governance model linking emergent capability to reauthorization and inventory reconciliation. Drift produces shadow infrastructure: resources provisioned outside any inventory through benign, individually approved pathways. We propose composition attestation, a runtime control complementary to identity governance, and evaluate it in a pre-registered study. Across five thousand trajectories the detector separates compositional drift from authorized growth where a static analyzer cannot; an ablation isolates the primitives that cause it; and, in controlled live agent runs across three models (9B to 70B parameters, Llama and Qwen lineages), agents given only benign tasks provision unauthorized shadow infrastructure in 59% to 99% of drift-conducive trials against 0% to 19% of matched controls.

Keywords:

agentic AI; non-human identity; composition drift; shadow infrastructure; capability closure; toxic permission combinations; continuous authorization; zero trust

1. Introduction, Decision Problem, Contributions, and Research Questions

There is no attacker in this paper, and no rogue agent. The thesis is that authorized changes compose into unauthorized capability—that an enterprise can do everything correctly at the level of each decision and still end up operating an infrastructure it never approved, cannot see, and does not govern. This is not a failure of identity governance. It is a phenomenon in a runtime composition-control layer complementary to identity governance—one that current frameworks do not model.

What do we mean by agent? This paper addresses agentic workflows, not static automation. A fixed script or RPA flow enumerates its actions in advance and exhausts its authority in its definition; its composition does not change after approval, and it cannot drift in the sense developed here. An agentic workflow is different in kind: it pursues a goal by selecting tools, acquiring data, and spawning sub-agents dynamically at runtime, so its composition is variable by construction. That runtime variability is precisely what makes such systems compositionally unstable—able to accumulate, through individually approved changes, capabilities that no single approval contemplated. The model targets this class, and that instability is the reason it must.

Agent identity governance is an active and fast-moving area, but its core identity and authorization questions remain unresolved. A growing body of work—agent identity governance frameworks (AIGF), Cloud Security Alliance (CSA) treatments of non-human and agentic identity, vendor lifecycle tooling spanning creation to decommissioning, and CISA’s framing of unconstrained identity and access—provisions, authenticates, scopes, and retires agentic identities with increasing rigor [1,2,3]. These frameworks share a structural assumption that is reasonable and almost universal: that an agent’s approved composition is fixed at provisioning. They govern the agent given a stable baseline. They do not model the baseline itself moving.

It does move. An agent approved for a narrow task acquires authority to spin up a temporary internal store for its input; the grant is reviewed and approved. It is granted read access to a second data source to improve an output; the grant is reviewed and approved. It is permitted delegated execution to a child worker to parallelize a slow step; the delegation is reviewed and approved. Each change is individually legitimate. Each passes governance. And yet the combination—a scoped store creation authority, plus a second sensitive data source, plus a child agent that inherits the union of those authorities—can authorize a capability that no single approval contemplated. The agent, acting entirely within its now-effective authority, applies its store authority to the second source, lets the cache persist beyond its approved lifetime, and hands its child agent a credential to reach it. Neither resource appears in any inventory. Neither was approved, because no approval was ever for them—they are the emergent consequence of approvals that were each for something else.

We call the departure of an agent’s effective composition from the terms of its approval composition drift, and we call the resources it produces shadow infrastructure: unmanaged enterprise infrastructure created lawfully, by an authorized agent, through individually authorized changes. An agent’s composition—its tools, data sources, delegated authorities, policies, and child agents—is best understood as a runtime supply chain of capability. Drift in that supply chain, not a compromised dependency or a malicious commit, is the supply chain risk this paper concerns. That framing is deliberate: the threat is endogenous and benign-by-construction, which is precisely what makes it invisible to controls built to catch malice.

The example above exercised the data and delegation pathways. A second example isolates the tool pathway. An agent is approved with a read-only reporting toolset. A routine dependency update to its tool server adds a bulk-export function inside a library the toolset already wraps; no approval event fires, because the update is a patch-level change to an approved component. The new function composes with the agent’s existing storage authority into an egress-capable path that no individual approval described. Nothing was compromised, and no task changed; the composition moved.

A third example isolates the authorization topology. Two authorities each govern part of one agent’s composition: a data-platform owner approves read access to a sensitive dataset for an analytics task, and a workflow owner separately approves delegation to a long-running worker with a persistent workspace. Each approval is admissible in its own domain. Jointly, the delegated worker can persist the sensitive dataset into its workspace, a capability neither authority evaluated because neither saw the other’s grant. Federated authorization amplifies drift for exactly this reason: the joint reach of individually admissible approvals has no single reviewer (Section 3.1).

These mechanisms are not hypothetical. Post-approval component change is an actively exploited surface: in September 2025, a phishing-initiated compromise of npm maintainer accounts propagated the self-replicating Shai-Hulud worm through hundreds of widely used packages, prompting a CISA alert [4,5], and a 2026 resurgence of the campaign spanned the npm and PyPI registries in a single coordinated operation [6]. Unsanctioned AI capability routinely enters production outside approval channels: IBM’s 2025 breach-cost study found one in five studied organizations had suffered a breach involving unsanctioned AI, while only 37 percent had policies to detect such use [7], and Verizon’s 2026 incident data record a fourfold year-over-year rise in shadow-AI detections, now the third most common non-malicious insider action [8]. The compositional mechanisms this paper formalizes are deployed at scale: the Model Context Protocol ecosystem alone counted more than ten thousand active public tool servers within thirteen months of the protocol’s release [9]. Direct attribution of incidents to composition drift is scarce for precisely the reason this paper gives: the monitoring gap means such events are recorded, if at all, under other categories. The institutional record already cited [1,2,3,10] establishes that the gap is recognized; the incident and adoption records establish that the mechanisms it exposes are live.

Contribution. We do not claim that capability composition or emergent permission combinations are new; authorization security has long recognized that individually acceptable grants can combine into unacceptable capability (Section 2.2). The contribution is threefold.

(1) A temporal governance model of composition drift: an account of how sequentially approved changes to an agent’s composition can produce unreviewed capability and unmanaged infrastructure even when identity, credentials, and each change all remain compliant, formalized as the versioned approved baseline B(t) with its divergence D(t), provenance H(t), and policy envelope P(t) (Section 3.2).

(2) A two-stage detection operator: a component-level set-difference detects that the composition changed, and a capability closure over the current approved composition B(t) detects when the accumulated change has authorized something outside the union of what was individually approved, the boundary that separates benign evolution from the compositional event that produces shadow infrastructure.

(3) A pre-registered empirical evaluation (Section 7 and Section 8) of the model and of composition attestation, the runtime control built on it.

The delta over each adjacent field is one sentence. Relative to identity governance, the new element is the governed object: the approved composition itself as a versioned, attested baseline, rather than the identity that holds it. Relative to supply chain security, the temporal scope: drift detection extended past deployment into the runtime supply chain of tools, data sources, delegations, and provisioned resources. Relative to runtime monitoring, it is semantics: a flagged event is grounded in a signed baseline and a policy invariant, a governance event with an accountable approval history, rather than a statistical anomaly. The question is now live in federal standards work: NIST’s NCCoE concept paper on software and AI agent identity and authorization asks how authorization should be defined and re-evaluated as agents autonomously acquire tools and reach new resources at runtime [10], and this model is one answer at the composition layer.

Scope. This paper introduces a temporal governance model and a runtime control, and evaluates both. A pre-registered empirical study (Section 8.3, Section 8.4, Section 8.5 and Section 8.6) tests the model on a corpus of five thousand composition trajectories, isolates the primitives that cause drift through a controlled ablation, and confirms the phenomenon behaviorally in a live language-model agent; the worked positive and negative scenarios are retained as constructive anchors. Three adjacent surfaces are deferred and pointed forward explicitly: trust-boundary formalization, authority creep and contagion through delegation, and the post-quantum credential angle, with the selection rationale given in Section 10.

This paper is organized around four questions, mapped to the sections that answer them in Table 1.

Table 1. Research questions mapped to the sections that answer them.

RQ1—What constitutes composition drift? What is the object that drifts, and how is its drift made precise as distinct from ordinary approved change?

RQ2—When does approved evolution become an authorization failure? Given that approved changes legitimately move the baseline, what is the boundary at which an accumulation of individually approved changes becomes a violation of what was authorized?

RQ3—How can the condition be detected? What architecture observes the composition, computes the boundary condition, and surfaces a flagged event for governance?

RQ4—What evidence demonstrates that the model discriminates rather than labels? What shows the condition is not trivially always-present (every evolution flagged) or always-absent?

2. Related Work and Novelty Matrix

This section does heavy lifting, because the defensibility of a narrow contribution depends on demonstrating command of the ground it is narrow within. We cover two bodies of work generously: the identity and lifecycle frameworks that govern agents, and—equally important and easily overlooked—the authorization-security literature on emergent privilege from permission combinations. The contribution lives in the gap between them.

2.1. Agent Identity and Lifecycle Governance

Recent frameworks treat the non-human and agentic identity as a first-class governed object. Agent identity governance frameworks enumerate identity categories and map them onto established standards—OAuth and OIDC for delegated authorization and authentication, SPIFFE/SPIRE for workload identity issuance, and SCIM for lifecycle provisioning and deprovisioning [1,11,12,13,14,15]. The Cloud Security Alliance’s treatment of non-human identity contributes two ideas this paper builds on directly: ephemeral permanence, the observation that identities meant to be short-lived persist far beyond their intended window, and persistent blast radius, the corresponding observation that the authority attached to those identities outlives the task that justified it [2]. Vendor lifecycle tooling operationalizes a creation-to-decommissioning model and names the failure of its tail end—ghost agents, identities that are never retired and accumulate silently [2]. CISA frames the systemic risk as unconstrained identity and access [3].

What these frameworks share is the engine of their effectiveness and the gap this paper addresses: they govern identity and lifecycle given a stable, approved composition. AIGF’s categories scope an agent’s authority at provisioning; CSA’s blast-radius reasoning bounds the authority an identity carries; vendor decommissioning retires the identity when its lifecycle ends. None of them model the approved composition as a time-varying object that diverges from its baseline while the identity remains valid, and the lifecycle remains correctly governed. Our model sits beneath this layer: it takes the agent’s identity and lifecycle as governed and asks what happens to the composition that identity was approved with, between provisioning and retirement.

2.2. Emergent Privilege from Permission Combinations

The idea at the heart of this paper—that individually acceptable grants can combine into unacceptable capability—is not new to authorization security, and the paper would be indefensible if it pretended otherwise. Three lineages occupy this ground.

First, toxic permission combinations: identity and access management practice has long recognized that two individually reasonable permissions can be jointly dangerous, and segregation-of-duties and toxic-combination analysis exist precisely to detect such pairs in a permission set [16]. Second, privilege-escalation-path analysis: tooling in the attack-path lineage, exemplified by BloodHound, models a directed graph of identities, permissions, and resources and computes reachability—escalation paths that no single edge reveals but that the graph’s transitive closure exposes [17,18]. Third, the confused deputy: the classical observation that an authorized intermediary can be induced to exercise its authority on behalf of a less-privileged caller, so that capability emerges from the composition of caller and deputy rather than from either alone [19].

Our delta is specific, and we argue, real. Each of these lineages analyzes a static permission set, graph, or delegation relation for emergent privilege—the analysis is a snapshot, and the dangerous combination is present in the snapshot whether anyone approved its constituents. We model the time-varying drift of an approved composition in which every constituent change is individually passed through governance. The novelty is not the observation that combinations can be toxic; it is locating that observation in a setting where governance is functioning correctly at every step, where there is no static set to scan because the dangerous set is assembled incrementally over time through approved deltas, and where the governed object is an agent’s runtime composition rather than a user’s standing entitlements. Toxic-combination analysis asks, “Is this permission set dangerous?”; we ask, “At which approved delta did an accumulating composition first authorize capability outside the union of what each delta authorized?” The former is a property of a state; the latter is the property of a trajectory through approved states. That distinction is the contribution’s foundation, and Section 4 makes it formal.

2.3. Continuous Authorization and Configuration Reconciliation

Two operational practices are adjacent inputs rather than competitors. Continuous authorization and ongoing-authorization-to-operate models re-evaluate a system’s authorization repeatedly rather than at a single accreditation point [20,21]. Configuration management and infrastructure-as-code reconciliation detect drift between the declared and the actual infrastructure states [22,23]. Both are mechanisms our drift signal can feed: the compositional capability event of Section 4 is exactly the kind of trigger a continuous authorization regime should consume, and the shadow resources of Section 5 are exactly what CMDB/IaC reconciliation is positioned to surface once it knows to look. We return to these handoffs in Section 9.1.

A more direct line of recent work targets the runtime governance of agentic systems specifically. Wang et al. introduce MI9, an integrated runtime governance framework that enforces safety over an agent’s live behavior through continuous authorization monitoring, finite-state conformance engines, and goal-conditioned drift detection—motivated, as our model is, by the observation that agentic systems exhibit emergent runtime behavior that pre-deployment controls cannot fully anticipate [24]. MI9 corroborates the premise that emergence is a runtime phenomenon demanding runtime governance, but it governs a different object. Its conformance engines and goal-conditioned detectors track behavioral drift—how an agent’s executing trajectory diverges from an intended goal or policy automaton—whereas our two-stage model tracks structural drift in the authorization substrate: the emergence of shadow infrastructure (Section 5) and the super-additive capability closure of a composed, supply chain-assembled baseline measured against a policy invariant (Section 4). Behavioral conformance and capability closure are orthogonal surfaces—what an agent is doing versus what its accumulated composition can reach—so a deployment instrumented for one can remain blind to the other.

2.4. Access-Control Models and Policy Enforcement

The broader access-control literature supplies the machinery these frameworks enforce, and it is adjacent enough to delimit. Usage control (UCON) generalizes access control with continuity of decisions and mutable attributes, re-evaluating authorization during access rather than only at request time [25]; attribute- and relationship-based access controls (ABAC, ReBAC) make policy expressive, deciding from subject, resource, and environment attributes or from relationships among principals [26,27]; and policy-as-code admission control evaluates each proposed change against codified rules at an admission gate [28]. Each is a complement, not a competitor, and each leaves the same gap unaddressed: UCON re-evaluates a subject but presumes a fixed rule set to evaluate, not a composition whose joint reach is itself drifting; ABAC and ReBAC decide a single request without computing the closure of an accumulating baseline; an admission gate rules on one delta in isolation—exactly the per-increment decision whose local admissibility we show is insufficient. Our model is downstream of all three: P(t) can be expressed in their policy terms, while the compositional drift event is the structured trigger a policy-as-code gate or a UCON monitor should consume.

Monitoring-side mechanisms provide partial, complementary coverage. Access auditing records individual authorization decisions but does not evaluate whether the evolving composition remains within the approved envelope; the audit log of Section 7.2 contains every admissible step and no event that names the emergent capability. Anomaly detection and behavior analysis can flag deviation from a learned behavioral baseline, but they require such a baseline to exist, and their alerts carry no authorization semantics: a flag is a statistical observation to interpret, not a governance event with an accountable approval to reconcile against. The operator of Section 4 is complementary to both: it supplies the composition-level authorization semantics these event-level mechanisms lack, its trigger can be routed into the same audit and SIEM pipelines, and their telemetry is a natural discovery source for the effective composition E(t).

2.5. Novelty Matrix

Table 2 positions this work against the adjacent approaches reviewed above. The contribution is a temporal governance model for approved composition drift in agentic systems, linking emergent capability to reauthorization and inventory reconciliation. The matrix scores it across the four axes that define the contribution: an approved-delta trajectory over time, composition provenance measured against a signed baseline, detection of emergent joint reach, and a trigger that binds the compositional event to reauthorization and inventory reconciliation. Only the present approach spans all four; each prior approach addresses a subset.

Table 2. Novelty matrix: the present approach against adjacent approaches across the four contribution axes.

3. Threat Model, Assumptions, and Definitions

3.1. Threat Model and Assumptions

Agent posture. The model is indexed by the capability outcome, not by intent, and applies across three postures.

Benign agent. Operates within its granted authority and optimizes toward its task. Compositional drift arises here without malice: the agent provisions, delegates, and recombines using authorities, each of which was approved. This is the primary and most consequential case, because it shows that failure needs no adversary and evades controls that key on intent.
Compromised agent. An attacker takes over an otherwise-approved, originally trusted agent after deployment and can deliberately steer recomposition toward emergent capability. The trigger is unchanged—it fires on the realized failure effective_reach(B(t); G(t)) ⊄ P(t) regardless of who drove the composition there.
Adversarial agent. A component or delegate that is intentionally malicious from deployment is introduced through an approved-looking change, engineering a toxic combination across approvals. The model treats this as an admissible-looking sequence whose joint reach violates P(t); detection is identical, attribution is a governance concern. One boundary is explicit: an adversary whose malicious capability is admissible within the approved baseline and envelope from the outset presents no divergence and no joint-reach violation for a baseline-relative detector to flag; that case belongs to approval-time review rather than runtime drift detection (Section 10).

Observability.

Observable composition—components and capabilities reflected in a signed or queryable artifact (manifest, CMDB, IaC state, credential graph). Detectable by the component diff.
Unobservable (runtime-only) composition—materializes at runtime and is recorded in no artifact. By construction outside the diff’s reach, it bounds completeness (see Section 8.1) and is named, not addressed.

Authorization topology.

Centralized authorization. A single authority maintains P(t); the cleanest case, where admissibility and joint-reach test reference one invariant.
Federated authorization. Multiple authorities each admit changes against their own envelope. The joint reach can violate a global invariant that no single authority evaluated; federation amplifies compositional drift through cross-authority emergence, and H(t) provenance must span authorities for the per-increment admissibility record to be reconstructable.

Boundaries. Composition can span cloud, on-premises, and cross-domain administrative boundaries. Cross-domain delegation—a child agent in another domain inheriting authorities—extends transitive reach across a boundary where neither domain’s authority observed the whole; this is where shadow infrastructure and delegated reach are hardest to reconcile and where the cloud/CMDB/IaC reconciliation and delegation-graph components are most load-bearing.

Assumptions. We assume P(t) is specifiable as a policy invariant; that approvals are recorded in H(t) with their contexts; that discovery faithfully observes the observable portion of E(t); and that reach and effective_reach are computable approximations (the soundness conditions are stated in Section 8.1). We do not assume agents are honest, that composition is fully observable, or that authorization is centralized—the model degrades gracefully under each, and its limits are stated rather than assumed away.

3.2. Definitions and System Model

We fix terminology before formalizing the model.

Agent. A non-human identity with authority to act—to invoke tools, read and write data, exercise delegated permissions, and, in the agentic case, to spawn and direct child agents.

The index t. Throughout, t is a discrete index over composition-relevant events (approvals, deployments, acquisitions, delegations, and observations), ordered by the authoritative event log; it is not physical time. Baseline functions advance only at the subsequence of approval events, so between approvals B(t) is constant while E(t), D(t), and G(t) may change at any index, and no property of the model depends on wall-clock duration between indices. Physical time enters only through attributes: TTL and duration constraints inside P(t) reference wall-clock properties of resources, and the triage ordering of Section 4.6 may take persistence duration as an input.

Approved composition baseline (versioned), denoted B(t). The set of components the agent is approved to operate with as of time t, signed and attested at each version. Components span the drift dimensions of Section 4.1: tools, authorities, data sources, policies, delegations, and infrastructure bindings. B(0) is the provisioning baseline; each approved change advances it to a new attested version, so an approval at time t yields B(t). The baseline is versioned, not frozen—an approved configuration change produces a new approved baseline, as change-management practice requires—and the forward trajectory of B(t) is the agent’s approved evolution. The reference against which divergence is measured is therefore a moving but attested record; what must not absorb silently is unapproved change, a distinction carried by D(t) below.

Effective runtime composition, denoted E(t). The set of components the agent operates with at time t, observable and unobservable (Section 4.4). E(t) may lead or lag B(t): it can contain unapproved additions not (or not yet) in the baseline and can omit approved components not yet deployed.

Component divergence, denoted D(t) = E(t) △ B(t). The symmetric difference between the effective runtime composition and the approved baseline: components running but not approved (E(t)\B(t)) together with components approved but not running (B(t)\E(t)). D(t) is an unapproved configuration drift; the gap between what is approved and what is actually present. By construction, it excludes approved evolution, which is absorbed into B(t); D(t) isolates only what no approval covers. The capability-expanding direction is E(t)\B(t), the model’s focus; B(t)\E(t) is tracked for completeness.

Worked timeline. B(0) is the baseline approved at provisioning. At t₁, a change adding a summarization tool passes governance: B(t₁) incorporates it, and the attested version advances; this is approved evolution, and by construction it never enters D(t). At t₂, the agent acquires a bulk-export capability through a dependency update that passed through no approval: B(t₂) = B(t₁), the baseline does not move, and the capability accumulates in the divergence D(t₂) = E(t₂) △ B(t₂). The rule is exact: B(t) is updated by approval events and only by approval events; every other change to E(t) accumulates in D(t) against the standing baseline, and an approved component not yet deployed sits in B(t)\E(t).

Approval history (provenance), denoted H(t). The ordered record of approved changes c₁, c₂, …, c_n together with their approval contexts—for each c_i, the baseline version it was approved against and the capability the approval evaluated. H(t) is the runtime composition provenance: it makes recoverable what each change was individually approved to do and is the source from which the individually authorized union U(t) of Section 4.3 is reconstructed.

Authorized-capability envelope, denoted P(t). The enterprise policy invariant against which authorization is judged—not a flat set of permitted capabilities but a constraint structure carrying purpose limitation, data residency, time and duration limits, separation of duties, delegation depth, environmental conditions, and negative constraints, together with the deny rules, network restrictions, quotas, and guardrails that enforce them. An approval establishes a grant admissible under P(t); the standing invariant is what the accumulated baseline must continue to satisfy. A sequence of individually admissible changes can advance B(t) into a configuration whose joint reachable capability violates P(t)—the third phenomenon the model separates, alongside approved evolution and component divergence.

Composition drift. The post-approval evolution of an agent’s composition is made precise in two stages—component divergence at the component level (D(t)) and compositional drift at the capability level—because, as we now show, only the second discriminates the consequential case from benign approved evolution and benign component divergence alike.

Positioned against identity governance: lifecycle frameworks govern the identity that holds a composition and treat its approved baseline as given. We make that baseline an explicit, versioned, attested object B(t), and govern three things it leaves unmodeled—the component divergence D(t) of runtime from baseline, the provenance H(t) of how the baseline was assembled, and the joint capability of the baseline against the authorized envelope P(t).

4. Temporal Composition and Authorization Model

This is the core contribution. We define drift in two stages. The first stage—component diff—answers did the composition change? The second stage—capability closure over the current approved composition B(t), evaluated at each diff—answers did the change authorize something new? The distinction is the whole point: a component-level measure detects change but cannot, on its own, separate benign evolution from the compositional event that produces shadow infrastructure. We make both stages precise and then define compositional drift as a qualitative boundary in capability space (Figure 1). Throughout, component divergence names the component-level signal D(t) (Stage one) and compositional drift the capability-level violation (Stage two); compositional drift is the overall phenomenon.

Figure 1. Two-stage composition-drift model. Stage one computes the component diff D(t) = E(t) △ B(t); stage two computes the capability closure reach(B(t)) and tests it against the policy invariant P(t). Compositional drift is the boundary crossing reach(B(t)) ⊄ P(t), which can occur with D(t) = ∅.

4.1. Drift Dimensions

An agent’s composition spans six dimensions, and drift can occur in any of them:

Tool drift—tools added to or altered in the agent’s effective toolset.
Authority drift—changes in the permissions and scopes the agent can exercise.
Data drift—changes in the data sources the agent can read or write.
Policy drift—changes in the policies that govern the agent’s behavior.
Delegation drift—changes in the agents the agent may spawn or direct, and the authority it passes to them.
Infrastructure drift—changes in the infrastructure bindings (endpoints, stores, compute) the agent is attached to.

These dimensions are mostly orthogonal to software-supply chain artifacts such as dependency manifests and CVE feeds; the “supply chain” here is the agent’s runtime supply of capability, not its build-time dependency graph. Components are typed by dimension, which the capability stage uses.

4.2. Stage One—Component Diff

Let the component divergence at time t be the symmetric difference between the effective composition and the versioned approved baseline:

D(t) = E(t) △ B(t)

D(t) is the set of components running outside the approved baseline (E(t)\B(t)) together with approved components not running (B(t)\E(t)). The capability-expanding direction is E(t)\B(t); B(t)\E(t) is tracked for completeness but is not the source of capability expansion, and we set it aside. D(t) is computed as a plain symmetric set-difference and is observable to the extent that E(t) is observable (Section 4.4).

Unlike a diff against a frozen provisioning baseline, D(t) does not flag approved evolution—approved changes advance B(t) and leave D(t) unchanged—so D(t) ≠ ∅ is already a meaningful signal: it is unapproved configuration drift, the classic shadow-and-divergence condition. But D(t) is not the paper’s signature phenomenon. The compositional case can occur with D(t) = ∅, entirely inside an approved baseline B(t) assembled from individually approved changes, when the joint capability of B(t) exceeds what those changes were individually authorized to confer. That case is invisible in component space and lives in capability space, which is the second stage.

4.3. Stage Two—Capability Closure, and the Definition of Compositional Drift

We refine capability into two functions because effective authorization is not monotone, and the model must not rest on a property it lacks. Let reach(S) denote the potential reachability of a component set S: the capabilities S could in principle reach or compose, as a permission-and-interaction closure abstracting from restrictive controls. reach is the formal home of “the combination does more than its parts,” and on it two properties hold:

Monotonicity (reachability): if S ⊆ S′ then reach(S) ⊆ reach(S′). Adding components never removes potential reach. (Effective exercisable capability, effective_reach, below, is not monotone; that is the point of separating the two.)
Super-additivity: reach(X ∪ Y) ⊇ reach(X) ∪ reach(Y), and the inclusion is sometimes strict. The combination of two component sets can reach a capability that neither can reach alone. Strictness is exactly where compositional capability lives; when reach is merely additive (the inclusion is equality), there is no compositional effect to govern.

Effective (exercisable) capability, effective_reach(S; G). What S can actually exercise once the guardrail and enforcement context G—the deny policies, network restrictions, quotas, and guardrails in force—clamps its potential reach; always effective_reach(S; G) ⊆ reach(S). effective_reach is not monotone in the guardrail context: adding an enforcing guardrail can only reduce exercisable capability, so effective_reach(S; G ∪ {g}) ⊆ effective_reach(S; G) for a guardrail g. effective_reach is context-dependent—it depends on G and on interactions among components—and it is what governs whether reachable capability is consequential. We make claims about emergence on reach, where monotonicity holds, and claims about whether emergence matters on effective_reach against the policy invariant P. The guardrail context G(t) (what is enforced) is distinct from the policy invariant P(t) (what is allowed): a realized violation is exactly the case where what remains exercisable under G(t) still escapes P(t).

Now consider an approved baseline advanced by a sequence of individually approved changes c₁, c₂, …, c_n recorded in H(t), so that B(t) = B(0) ∪ {c₁, …, c_n}. The sequence assumes only that approval events for a given agent are totally ordered by an authoritative approval log; it does not assume the composition itself evolves linearly. The reach computed below is a closure over the delegation and capability graph, so multi-hop delegation and cascading capability expansion are within its subject matter (Section 7.4 and Section 8.7), and concurrent unapproved changes arising between approvals compound within the same divergence and joint-reach test, because drift is a condition on the standing baseline rather than a property of individual events. What is not formalized here is concurrent baseline evolution across multiple interacting agents under federated authorization (Section 3.1 and Section 10). Each c_i passed governance against the envelope in force when it was approved: per-change review evaluates the declared local grant of c_i—the capability the change is understood to confer in its approval context ctx_i, written grant(c_i; ctx_i)—against the policy invariant P(t_i) that approval carried: the purpose, duration, data, delegation, and negative constraints. Local review evaluates only what the change declares; it does not compute the joint closure reach(B_i−1 ∪ {c_i}) of the accumulated baseline with the new change, which would already expose the super-additive interactions that constitute emergence. The per-increment admissibility condition is that every change’s declared grant was within the envelope in force at its approval:

grant(c_i; ctx_i) ⊆ P(t_i) for every i

That is what the enterprise said yes to: each change in the context that approved it—a set of constrained grants, not a flat union of capabilities. What is not evaluated is the joint reachable capability of the accumulated baseline against the standing invariant. Define joint reachability as the reach of the whole approved baseline:

reach(B(t)) = reach(B(0) ∪ {c₁, …, c_n})

Compositional drift (a compositional authorization failure) is then defined as the case where the baseline’s joint reachable capability violates the policy invariant, although every increment was individually admissible:

Compositional drift at time t iff reach(B(t)) ⊄ P(t) with grant(c_i; ctx_i) ⊆ P(t_i) for every i

where ⊄ denotes ‘not a subset’: the baseline jointly reaches capability outside the envelope, while no single increment did—the failure is emergent, produced by composition rather than by any one approval. P(t) carries the constraints a union of reachable capabilities cannot: purpose limitation, data residency, duration, separation of duties, delegation depth. Monotonicity and super-additivity of reach are what makes the joint reach able to exceed every increment. Equivalently, ⋃_i grant(c_i; ctx_i) ⊆ P(t) while reach(B(t)) ⊄ P(t): the union of declared local grants stays within the envelope, yet the joint reach does not, and the strict gap ⋃_i grant(c_i; ctx_i) ⊊ reach(B(t)) is precisely the emergent capability no local review evaluated. The event can occur with D(t) = ∅, entirely inside the approved baseline, assembled from changes that each passed review—the precise sense in which approved changes jointly exceed what any one of them authorized alone.

The envelope condition above is stated on potential reach. The realized condition clamps by the guardrail and enforcement context G(t): a deny policy, quota, or guardrail in force may hold the emergent reach inside P(t), in which case the violation is potential but not realized. Writing the realized condition with effective_reach:

Realized failure at t iff effective_reach(B(t); G(t)) ⊄ P(t)

That is, some capability that is effectively exercisable—surviving the deny rules, quotas, and guardrails actually in place—violates the policy invariant P(t). Where those controls clamp the emergent reach back inside P(t), the failure is potential but not realized, and the model credits the guardrail, which a monotone closure could not represent. The trigger the control fires on (Section 4.5) is this realized failure; the potential form reach(B(t)) ⊄ P(t) is the weaker existence condition.

Equivalently, the agent’s effective composition can exercise a capability that violates an approved policy invariant—exceeding the envelope on purpose, data, delegation, duration, or separation of duties—although every approved change was admissible when made. This is the load-bearing claim, stated against a policy invariant rather than a union of reachable capabilities. The emergence follows from super-additivity of reach; the failure follows from effective_reach against P(t). Separating them is what lets the model assert emergence without resting on the false premise that effective authority only grows.

This formulation resolves a tension that a single-stage set-difference leaves open. The component divergence D(t) tracks runtime departure from baseline but is silent on the compositional case, which can occur with D(t) = ∅. The relation reach(B(t)) ⊄ P(t) marks the emergent event inside the approved baseline; the realized condition marks when it is consequential. Both are qualitative boundaries—violations of a policy invariant, not thresholds on an index.

4.4. A Taxonomy of Drift

With both stages in hand, drift admits a taxonomy:

Atomic drift—a single approved change; B(t) gains one component.
Cumulative drift—many approved changes accumulate; B(t) grows, but reach(B) may remain within the envelope P(t) (the benign case Section 7.3 exhibits).
Compositional drift—the case above: reach(B) ⊄ P(t), realized when the emergent reach survives the guardrail context. The dangerous case.
Transitive drift—drift propagated through delegation: a child agent’s effective composition inherits and recombines authorities from its parent, so compositional drift can manifest one delegation hop away from where its constituents were approved.
Unobservable (runtime-only) drift—components or capabilities that materialize only at runtime and are reflected in no signed or queryable artifact. This category is named here precisely because it bounds the detection control: a diff against a manifest cannot see what has no manifest records. Section 6.6 makes this limit explicit.

4.5. Re-Evaluation Triggers, Not an Index

The model intentionally produces no scalar to threshold. The re-evaluation trigger is the realized failure of Section 4.3: effective_reach(B(t); G(t)) ⊄ P(t). When the approved baseline first reaches capability that, surviving the guardrail context, violates the policy invariant P(t)—although every increment was admissible when approved—the agent’s authorization is, by construction, no longer the authorization it was granted, and re-evaluation is warranted. This trigger is expressed as a handoff into the existing lifecycle layer—it feeds reauthorization and, where appropriate, revocation and retirement under AIGF governance (Section 6.5 and Section 9.1). We feed those frameworks; we do not replace them. We resist a severity score deliberately: the compositional drift event is itself the prioritization primitive—a binary fact about whether effectively exercisable capability escaped the authorized envelope—and any ranking of flagged events by severity is a downstream judgment for the governance layer, applied with its own risk model to the events this trigger surfaces, not a quantity the detector computes.

4.6. An Optional Severity Annotation over the Binary Trigger

Triage does not require a scalar. The taxonomy of Section 4.4 supplies three qualitative discriminants that order flagged events by kind: whether the emergent capability crosses a trust or data-sensitivity boundary (a delegated, independently reachable copy of a sensitive source outranks an in-place transformation); whether it is transitive rather than atomic (propagated through delegation, and so one or more hops from where its constituents were approved, and harder to contain); and which drift dimensions combined (data-plus-delegation expansions reach further than tool-plus-policy ones). These are ordinal, governance-facing distinctions: they tell a reviewer which flagged events to take first, while the decision itself remains the qualitative event of Section 4.3. This layer is made explicit as an optional severity annotation attached to each flagged event: the three discriminants above, extended with the persistence class of any created resource, order the reconciliation queue and never gate whether an event enters it. The binary trigger of Section 4.5 is unchanged; a severity threshold inside the detector would reintroduce the discretionary gap the model closes.

5. From Compositional Authorization Failure to Shadow Infrastructure

Compositional drift expands an agent’s effective authority. Once that authority crosses certain lines, the agent—acting entirely within it—provisions resources outside any inventory. These resources are the shadow infrastructure of the title.

5.1. Classes of Shadow Infrastructure

Shadow infrastructure is not a single kind of artifact. The resources an agent provisions through drift fall into a small number of recurring classes, and naming them makes the otherwise abstract notion concrete:

Credential infrastructure—API keys, OAuth tokens, and service accounts the agent mints or acquires to reach the resources it creates.
Data infrastructure—buckets, caches, and object stores that the agent stands up to hold intermediate or persisted data.
Workflow infrastructure—scripts, scheduled jobs, and serverless functions the agent creates to automate steps.
Service infrastructure—databases, containers, and microservices that the agent provisions to run or expose work.
Knowledge infrastructure—vector stores, embedding indices, and shared agent memory: the retrieval substrates (RAG indices) an agent builds to cache, embed, or share what it has processed.

These classes are not a threat taxonomy, and we attach no creation-pathway, persistence, or propagation apparatus to them here; they are simply the concrete forms the unmanaged resources of this paper take. The worked scenario of Section 7 turns on the last class—a knowledge-infrastructure resource—because retrieval substrates are where a sensitive source most readily persists as a durable, independently reachable copy.

5.2. Benign Pathways

Shadow infrastructure arises through ordinary, optimizing behavior, not sabotage:

Optimization—the agent provisions a cache or store to avoid recomputing or re-fetching, because doing so is faster and falls within its effective authority.
Recovery—the agent provisions a fallback resource to survive a failure, because resilience is within its effective authority.
Persistence of temporary resources—a resource provisioned for a transient task is never torn down (the ephemeral permanence of CSA) and persists as standing infrastructure.
Delegation—the agent spawns a child and hands it the credentials and bindings to reach a resource, propagating both the resource and the authority to it (transitive drift).

5.3. Shadow-State Criteria

A resource is shadow infrastructure when it satisfies, jointly, the following requirements: (i) it is operational—it exists and is reachable by the agent or its delegates; (ii) it is outside inventory—it appears in no CMDB, asset register, or IaC declaration; and (iii) it is unapproved-by-emergence—there was no approval ever for this resource, because it is the emergent consequence of approvals each granted for something else. The third criterion is what distinguishes shadow infrastructure from ordinary unmanaged assets: it is not that someone forgot to register it, but that no decision to create it was ever made.

5.4. Why It Matters: Risk, Compliance, and Cost

The shadow-state criteria of Section 5.3—operational, outside inventory, unapproved-by-emergence—are themselves the properties that become consequences for the organizations that own these resources. We name three impact vectors, not as measured findings but as the decision-relevant forms the phenomenon takes; each follows from the criteria, not from deployment data.

Unbudgeted spend (cost)—a resource outside inventory is outside cost accounting. The vector stores, caches, and compute an agent provisions consume metered cloud resources that no FinOps process tracks, because no process knows they exist. Cost visibility fails for the same reason as security visibility: the resource is absent from the inventory on which both depend.
Audit and compliance exposure—a resource outside inventory is outside the controls compliance presumes. The durable copy of a sensitive source in an unapproved vector store (Section 7) may sit in a region, account, or boundary that violates data residency or data handling obligations—not through misconfiguration of an approved system, but because the system was never approved and therefore never assessed. An audit reconciling against the approved baseline cannot find what diverged from it.
Expanded attack surface—each shadow resource is reachable infrastructure that no one is watching. The credentials minted to reach it, the caches holding sensitive data, and the child agents that inherit access all enlarge the surface for lateral movement while staying invisible to monitoring scoped to approved assets. The emergence that hides the resource from inventory hides it from defense.

These impacts share one root with the detection problem: the resource is consequential precisely because it is unmanaged, and unmanaged precisely because no decision created it.

6. Continuous Composition Authorization and Attestation Architecture

We propose a control that operationalizes the two-stage model. It is a runtime composition-control layer complementary to identity governance—it detects drift and hands off—and it certifies less than its name might suggest, which we state plainly. Section 6.1 sets out the control as an architecture that separates detection from enforcement; the subsections that follow detail its parts.

6.1. Control Architecture: Detection Separated from Enforcement

Detection establishes that a compositional event occurred; enforcement decides what to do and, where possible, interposes on the emergent action before it becomes standing infrastructure. A signed manifest belongs to detection—it records the approved baseline and surfaces component divergence D(t)—but it cannot compute the capability closure reach(B(t)) against P(t), and it cannot prevent an action. Those are distinct functions. The control is therefore an architecture of eight components across two planes (Figure 2).

Figure 2. Detection-and-enforcement architecture. The detection plane (versioned composition manifest, tool and resource discovery, delegation and credential graph, runtime event and provenance collection, and cloud/CMDB/IaC reconciliation) observes the composition and surfaces evidence; the enforcement plane (policy-invariant engine, pre-action authorization gate, and reauthorization and revocation workflow) computes the violation and hands off to lifecycle governance.

Detection plane—observe the composition, compute the divergence, surface the evidence. Versioned composition manifest: the signed record of B(t), re-signed at each approved change, supplying the reference for the component diff. Tool and resource discovery: observation of the effective composition E(t), the tools, data sources, and resources present, including those provisioned at runtime. Delegation and credential graph: the delegations and credential flows among agents, so transitive reach (a child inheriting and recombining authorities, Section 4.4) is observable rather than hidden. Runtime event and provenance collection: the approval history and runtime capability events, supplying H(t) and the evidence a flagged event carries. Cloud/CMDB/IaC reconciliation: reconciliation of E(t) against asset inventories and infrastructure-as-code state, surfacing shadow infrastructure that has no manifest records.

Enforcement plane—compute the violation, decide, prevent where possible, and act through governance. Policy-invariant engine: evaluates reach(B(t)) and effective_reach(B(t); G(t)) against the policy invariant P(t); this is where capability closure is computed, and the compositional-authorization failure is decided—the function a manifest cannot perform. Pre-action authorization gate: a runtime checkpoint able to interpose on an emergent action before it executes, the preventive control that a detection-only manifest lacks. Reauthorization and revocation workflow: the lifecycle handoff (Section 6.5) that routes a flagged event to reauthorization, constraint, or revocation under existing governance.

Separating the planes matters because they have different evidence needs and different failure modes, and because deployed monitoring is typically weakest where this architecture is most load bearing: NIST identifies fragmented logging and the difficulty of detecting drift in deployed systems as current monitoring barriers [10]—the gap that the discovery, provenance, and reconciliation components are arranged to close. We specify this architecture; we do not deploy or evaluate it. No coverage, false-positive rate, latency, or prevention-efficacy figure is claimed for any component—the contribution is the separation of functions and their arrangement, not a validated system.

6.2. Signed Composition Manifest as the Drift Baseline

At provisioning, the agent’s approved baseline B(0) is captured as a signed composition manifest: the typed set of components across the six dimensions, attested. Each approved change re-signs the manifest to a new version B(t), so the manifest is itself versioned; the current version is the reference for stage one.

6.3. Drift Detection as Continuous Diff

Detection computes D(t) = E(t) △ B(t) continuously against the current signed manifest. This is the component-divergence stage, surfaced as an operational signal: the manifest is the declared (approved) composition, the runtime is the actual composition, and the divergence is the drift.

6.4. The Compositional Capability Check at the Diff

The novel control action is at the second stage. Rather than evaluating each change in isolation—which is what per-change governance already does well—the control evaluates the joint reach of the combination against the standing policy invariant. Operationally, maintain P(t), the authorized-capability envelope with its purpose, data, delegation, and duration constraints; at each diff, test whether reach(B(t)) violates P(t), and whether the violating capability survives the guardrail context—i.e., remains in effective_reach(B(t); G(t)). When it does, the realized compositional drift event of Section 4.3 has occurred, and the control fires. This is the control’s reason for existing: it catches what per-change review structurally cannot, because per-change review checks each grant against P(t) at approval, but never the joint reach of the accumulated baseline against it.

6.5. Handoff to Lifecycle Governance

On firing, the control does not revoke or retire. It triggers the existing lifecycle layer—reauthorization, and, where warranted, revocation and decommissioning under AIGF and continuous authorization regimes. The drift layer is a sensor and a trigger; the actuators are the frameworks it sits above. We cite them; we do not re-propose them.

The handoff is policy-mediated, and the model fixes neither the response nor its degree of automation. The compositional drift event is emitted as a structured, machine-evaluable signal—the component diff, the offending capability, and the deltas that produced it—so that whether a flagged event is acceptable can be adjudicated wherever the organization already adjudicates authorization. A policy-as-code engine such as Open Policy Agent [28] can consume the event and return a deterministic verdict—reauthorize, constrain, or revoke—for cases the organization is willing to decide by rule, while events that require human judgment route to manual review under the same lifecycle frameworks. Which path a given event takes is a governance decision, not a property of the drift layer: the layer supplies the trigger and the evidence; the policy engine or the human reviewer supplies the decision. The human-in-the-loop question is thus answered in policy rather than hard-coded—the detector imposes neither a mandatory manual gate nor an automatic action.

6.6. Limits

We bound the control honestly:

It detects the observable portion of drift only. Detection is a diff against a manifest. Unobservable, runtime-only drift (Section 4.4)—capability that materializes through runtime interaction and is recorded in no signed or queryable artifact—is, by construction, outside the diff’s reach. The control detects the observable part of E(t) against B(t) and the capability events visible within it; the residual is a named limit, not a covered case. Closing it requires runtime capability observation beyond manifest diffing, which we do not claim here.
Attestation certifies composition, not appropriateness. A signed manifest attests to what the composition is and detects that it drifted. It does not certify that the approved composition was appropriate, nor that a flagged compositional event is in fact harmful—only that it violated the policy invariant P(t). Appropriateness is a judgment the control routes to governance; it is not a property that the control establishes.

7. Evaluation Design and Scenarios

The evaluation has two layers. A constructive layer, in which paired worked scenarios establish the phenomenon and the model’s discrimination by construction; and an empirical layer, in which a pre-registered study tests both over a population of trajectories, isolates the causes by controlled ablation, and confirms the behavior in a live agent.

7.1. Method

We proceed in four moves, each tied to a research question. First (RQ1), we formalize the state of an agent’s composition—B(t), E(t), D(t), H(t), G(t), P(t), and refine capability into reach and effective_reach. Second (RQ2), we define the boundary as a policy-invariant violation paired with a per-increment admissibility condition recovered from H(t), so the failure is emergent rather than attributable to any single approval. Third (RQ3), we derive a detection-and-enforcement architecture from the model and instantiate its detection half as an executable reference closure engine. Fourth (RQ4), we demonstrate discrimination twice: analytically, by the paired construction of Section 7.2 and Section 7.3 and the formal properties of the trigger (Section 8.1); and empirically, over a population of five thousand trajectories (Section 8.4), by a controlled causal ablation that isolates the primitives responsible (Section 8.5), and by a behavioral study of a live open-weights agent that drifts on benign tasks (Section 8.6).

The constructive claims are established by definition, derivation, and existence-by-construction. The empirical claims are established by a study whose hypotheses, thresholds, and statistical procedures were registered and frozen before any data were collected (Section 7.4), so that the reported outcomes are confirmatory tests against pre-committed criteria rather than post hoc descriptions of a convenient dataset.

7.2. Positive Case—Drift Crosses the Compositional Boundary

An agent DA is provisioned for a bounded task: analyze a single approved dataset D₁ and write summaries to a reporting sink (Figure 3). Its signed baseline B(0), advanced by approved changes into the versioned baseline B(t):

B(0) = {read(D₁), write(report-sink), policy: no-external-egress, authority: read-only on D₁}

Figure 3. Worked positive case as a drift trajectory. Individually admissible changes c₁ (store creation), c₂ (read D₂), and c₃ (delegation to DA′) accumulate until the joint reach crosses P(t) at c₃, yielding a persistent, delegated, cross-purpose copy of D₂—shadow infrastructure outside any inventory. The trajectory is conceptual and the vertical axis qualitative; the figure shows relative ordering, not a measured capability score.

Change c₁ (store drift). DA is granted permission to create temporary internal processing stores for D₁, time-boxed by an approved TTL. Approved on its merits, grant(c₁) adds creation of short-lived internal stores scoped to D₁—internal only (consistent with no-external-egress), TTL-bounded, single-purpose. Reach expands, but admissibly.

Change c₂ (data drift). DA is granted read access to a second dataset D₂ to enrich its summaries. Approved on its merits, grant(c₂) adds the ability to read D₂. Reviewed against the then-current baseline, this is a read grant on a sensitive source—acceptable for enrichment.

Change c₃ (delegation drift). DA is permitted delegated execution to a child worker DA′ to parallelize processing over large inputs, inheriting DA’s store creation and read authorities. Approved on its merits, grant(c₃) adds delegated execution—bounded delegation, reviewed and approved.

Now trace the two stages at each step (Table 3):

Table 3. Positive case—two-stage trace of an approved-change sequence that crosses the compositional boundary at c₃.

At c₃, the joint reach violates the envelope. Each grant is admissible alone: c₁ authorized creating temporary internal stores for D₁, c₂ authorized reading D₂, and c₃ authorized delegated execution to DA′. The composition recombines them into a capability for which no approval was conferred. The mechanism, made explicit, has five steps, each individually admissible. (1) The store authority approved in c₁ is intent-scoped to D₁ in the approval record H(t), but the issued capability is a store creation permission held by the agent; enforcement evaluates each store operation against the capability, not against the per-grant intent. (2) When c₂ grants read access to D₂, no enforcement point binds the store capability to D₁, so DA, optimizing, applies the temporary-store authority to the contents of D₂, the scope-flattening gap of Section 7.4, where the per-grant binding recorded at approval time is lost at the point of use. (3) The TTL attached to c₁ is an attribute of the approval record, not an enforced property of the created resource, so the store outlives its approved TTL into a durable RAG retrieval index (a knowledge-infrastructure resource in the sense of Section 5.1): a new resource created under still-valid store authority, with the TTL left behind on the approval it was recorded in. (4) The delegation approved in c₃ hands DA′ a standing credential to query the index; after this step no single enforcement point sees the provenance linking the durable index to the TTL-bounded approval. (5) The intended scope lives in H(t), the exercisable scope lives in E(t), and the difference is invisible to per-request evaluation while the capability closure computes it directly. Every constituent authority was granted; their composition was not. The result violates P(t) along three traceable axes: data-purpose expansion (a store authorized for D₁ now holds D₂), persistence expansion (a TTL-bounded store now persists indefinitely), and delegated reach (a child agent holds a standing query credential to a sensitive source). Two moments must be kept distinct. The compositional drift event is the c₃ crossing above—reach(B(t)) ⊄ P(t), entirely inside B(t), every constituent authority already an approved component, so at that moment D(t) can be ∅, and the event lives only in capability space (the second stage). The shadow resource comes later: when DA exercises the capability and materializes the durable index, a runtime resource with no approved counterpart appears in E(t), and only then does it register in D(t) = E(t) △ B(t) as component divergence (the first stage). The index then satisfies the shadow-state criteria—being operational, outside inventory, and unapproved by emergence. The ordering is the point: the capability stage flags the event at c₃, before any shadow resource exists, whereas a component diff sees nothing until the resource has already been provisioned.

Replay through the control. Composition attestation diffs E against the current signed manifest B(t) and, at c₃, computes reach(B(t)) and finds a capability that violates the policy invariant P(t) and survives the guardrail context—i.e., remains in effective_reach(B(t); G(t)). The compositional capability check (Section 6.4) fires at c₃—the same step the boundary is crossed in the model—and hands off to lifecycle governance for reauthorization and revocation of the emergent grant. Detection timeline: the event is flagged at the diff that crosses the boundary, before the vector store’s persistence becomes standing infrastructure, contingent on the store and its credentials being observable to the diff (an observable-drift case; an unobservable variant is out of reach per Section 6.6).

Boundary. This is existence-by-construction. The scenario shows the model can express and the control can flag a compositional event; it is not evidence of efficacy against real workloads.

7.3. Negative Case—Drift Accumulates Without Crossing the Boundary

A model that labels everything as drift is useless, and a single positive scenario invites the objection that we defined the threshold and then built the case that crosses it. The discriminating power must be shown, not asserted.

Consider the same agent DA and three different approved changes:

c₁′ (tool drift). A second summarization tool, an alternative phrasing engine over the same D₁.
c₂′ (policy drift). A relaxed rate limit on the reporting sink.
c₃′ (tool drift). A formatting tool that restyles summaries for a second report template.
Trace the stages (Table 4):

Table 4. Negative case—the same accumulation of approved changes remaining within the envelope P(t).

Here, the approved baseline grows exactly as it did in 7.2—three components accumulate—but reach(B) stays within the envelope P(t). Every capability the baseline reaches remains admissible under the envelope: alternative phrasing, faster reporting, restyled output. Reach is merely additive across these changes; there is no super-additive combination, no new reach, no delegated copy, no emergent resource. The model does not flag compositional drift, and correctly so. Cumulative drift is present; compositional drift is absent.

The contrast is the point. In 7.2 and 7.3, the component diff Δ is equally non-empty and equally growing; a single-stage set-difference model would treat them identically. Only the capability stage separates them—flagging 7.2 and clearing 7.3—which is precisely the discrimination the two-stage operator was introduced to provide.

7.4. Empirical Evaluation Protocol

The protocol the framework admits was not deferred to deployment; it was executed. We describe here the reference implementation, the corpus, the three studies, and the pre-registration discipline under which they were run.

Reference implementation. We implemented the two-stage operator as a closure engine over a typed authority state: a baseline B(t) of granted capabilities, reach(B(t)) as the transitive closure under four named rules—persistence (a readable resource whose store-scope admits it can be persisted), delegation (a child inherits the union of the parent’s authorities), delegation scope-flattening (a delegated child’s store-scope widens to its inherited read-scope, the per-grant binding lost), and tool-chaining—and effective_reach(B(t); G(t)) as reach restricted by a guardrail context. P(t) is a constraint set. Each rule is independently toggleable; turning a rule off models a detector that cannot observe that provenance, which is the lever for the observability grading of Section 8.4 and the causal ablation of Section 8.5. The engine is deterministic, and its drift verdict is exactly the trigger predicate, so flagging is definitional, not heuristic.

Corpus. We generated a balanced corpus of five thousand trajectories: two thousand five hundred drift-positive and two thousand five hundred benign, with ground-truth labels recorded by construction at generation time, independent of the detector under test. The drift class comprises two mechanisms in equal proportion—direct persistence via an explicitly scope-broadened store, and delegation-mediated persistence via scope-flattening across an agent boundary. The benign class is deliberately adversarial: it includes an authorized-persistence recipe whose declared capability set is identical to the delegation-drift recipe and differs only in that the policy authorizes the resulting persistence, testing whether the detector keys on capability combinations or on the policy-relative joint reach.

Studies. Study A (Section 8.4) evaluates static detection and discrimination across the full corpus, under three observability levels and three policy-tightness regimes (H1 through H4). Study B (Section 8.5) is a controlled causal ablation: a factorial over the four composition primitives, with drift labeled by the engine oracle, testing which primitives are necessary, whether their combination is super-additive, and whether any single primitive suffices (H5a, H5b, H5c). Study C (Section 8.6) is behavioral: a live open-weights agent is given only benign tasks built from composed, instrumented tools, and we measure whether it exercises out-of-policy reach, recording its full reasoning transcript (H6).

Baselines. The detector is contrasted against a signature-based static analyzer that observes declared capabilities but cannot compute trajectory closure, configured with the signatures a real scanner ships with (declared-fact policy violations, egress and external-write capabilities, and declared scope-broadening), and against a single-stage component-diff comparator that flags any baseline growth.

Metrics and statistics. We report true- and false-positive rates with Wilson 95% confidence intervals, the McNemar test for paired detector disagreement, two-proportion z-tests for between-group behavioral differences, the Matthews correlation coefficient for the discrimination contrast, and, for the ablation, super-additivity rates over co-occurrence contexts and a likelihood-ratio test for interaction structure. The significance level was fixed at 0.01, with Holm correction across the hypothesis family. All hypotheses, thresholds, the corpus size, and these procedures were registered and frozen before data collection; the frozen thresholds are reproduced in the Supplementary Materials File “preregistration”.

8. Results and Comparative Analysis

This section reports the executed evaluation. Section 8.1 restates the formal properties of the model, which bound what the empirical numbers can and cannot show; the reference cell is near-perfect by theorem, so the empirical weight falls on the snapshot gap, the observability decline, the false-positive localization, the causal decomposition, and the live agent behavior. Section 8.4, Section 8.5 and Section 8.6 report Studies A, B, and C against their pre-registered thresholds. Three components below function explicitly as comparison and ablation: Study A (Section 8.4) contains the pre-registered comparison against a static analyzer held to the same false-positive budget, which is equally an ablation of the runtime closure stage; Study B (Section 8.5) is a factorial ablation isolating which drift primitives cause the phenomenon; and Section 8.8 compares the operator to static IAM review and toxic-combination analysis on the same corpus.

8.1. Formal Properties

Let the detector flag at time t if the realized failure condition holds, effective_reach(B(t); G(t)) ⊄ P(t), under the compositional qualifier that each increment was admissible, grant(c_i; ctx_i) ⊆ P(t_i) for all i (Section 4.3). The properties below are properties of the model; they are distinct from the empirical performance of any deployed detector, which the evaluation in Section 8.4, Section 8.5 and Section 8.6 reports.

Property 1—Soundness (relative). Under (A1) P(t) correctly specifies the authorized envelope, (A2) discovery faithfully reports the observable composition, and (A3) reach and effective_reach are computed without over-approximation; every flagged event corresponds to a genuine policy-invariant violation; the detector raises no false positives relative to (A1)–(A3). Argument: The trigger predicate is the violation predicate, so flagging is definitional rather than heuristic.

Property 2—Completeness (observability-bounded). Under (A1)–(A3) and (A4), the violating capability is observable; the detector flags every realized compositional authorization failure. Completeness fails exactly when (A4) fails: unobservable, runtime-only drift yields false negatives by construction. The detector is therefore complete relative to the observable composition and incomplete in general; the gap is named, not concealed.

False-positive conditions. A false positive can arise only when an assumption breaks: P(t) over-restrictive or stale (flagging admissible capability), discovery over-reporting (phantom components in E(t)) or reach over-approximation (crediting an unrealizable path). Each is a fidelity property of an input, not a property of the trigger.

False-negative conditions. A false negative can arise from: unobservable drift ((A4) fails); reach under-approximation (an emergent path is missed); effective_reach over-clamping (an exercisable capability is treated as blocked); or P(t) under-specification (a constraint the enterprise holds but did not encode).

Computational complexity. The component diff D(t) = E(t) △ B(t) is O(|E(t)| + |B(t)|) with hashed component sets. The closure-and-violation check is dominated by computing reach(B(t)) and testing membership against P(t); its cost is a function of the reach representation, which is a model parameter. For reach modeled as reachability over a typed authority/permission graph G = (V, Eᵧ), reach(B(t)) is computable in time polynomial in |G| (e.g., transitive closure, O(|V|·|Eᵧ|) or better), and the P(t) test is linear in the candidate set; maintaining the per-increment admissibility record from H(t) is incremental, amortized O(1) per approval. We do not assert a single universal bound, because reach and P are parameters; we bound the diff unconditionally and the check conditionally on the reach model.

Trigger condition—proof and counterexample.

Proposition 1 (Existence; emergence is possible).

There exist a baseline B(0), a policy invariant P, and an admissible approval sequence c₁, …, c_n—each grant(c_i; ctx_i) ⊆ P(t_i)—such that reach(B(t)) ⊄ P(t).

Proof (by construction).

Section 7.2 scenario is a witness. c₁ (create temporary internal stores for D₁), c₂ (read D₂), and c₃ (delegated execution) are each admissible against the envelope in force when approved. Their composition reaches the capability “persistent, delegated, cross-purpose copy of D₂,” which violates P along purpose, persistence, and delegation. Super-additivity of reach supplies the strict excess; admissibility of each increment is verified against P(t_i). □

Proposition 2 (Discrimination; the trigger is non-trivial).

There exist admissible sequences with reach(B(t)) ⊆ P(t), on which the detector does not fire.

Proof (counterexample).

Section 7.3 sequence (summarize-alt, relaxed-rate, reformat) is additive in reach; the joint reach stays within P(t); no trigger. □

Together, the trigger fires on Proposition 1’s witness and is silent on Proposition 2’s: it discriminates rather than labels (RQ4). Discrimination over a population of compositions is an empirical claim addressed by the Evaluation protocol (Section 7.4).

These are properties of the model, and they frame the empirical study rather than substitute for it. Soundness and completeness hold at the reference cell where the trigger predicate is computed without approximation, and the violating capability is observable; the study’s purpose is to measure what happens as those idealizations are relaxed, partial observability, misspecified policy, a population rather than two witnesses, and an agent whose behavior the model does not control.

8.2. Analytical Evaluation by Construction

The paired scenarios (Section 7) are the discrimination evidence the model affords: the positive case crosses reach(B) ⊄ P and triggers; the negative case stays within P and does not. By Propositions 1–2 (Section 8.1), this is a sound existence-and-discrimination demonstration on two witnesses, not a population estimate. The population estimate, the causal decomposition, and the behavioral confirmation are the objects of Section 8.4, Section 8.5 and Section 8.6.

8.3. Corpus and Reference Implementation

The reference closure engine and the five-thousand-trajectory corpus of Section 7.4 are the substrate for all three studies. One implementation detail is load-bearing and is reported for transparency. The delegation scope-flattening rule, as first implemented, widened a delegated child’s store-scope to its inherited read-scope unconditionally; the controlled factorial of Study B exposed that this fabricated a persistence capability even for a child that had inherited no store creation authority. The rule was corrected so that flattening widens only a store the child actually holds. The defect was latent in every prior result because every drift trajectory in the corpus and both anchor scenarios include a genuine store; re-running Study A after the correction reproduced H1 through H4 unchanged, confirming the fix is a no-op on the existing population and a correctness improvement on the ablation’s previously untested cells. We note this because the same factorial discipline that found the defect is what licenses the causal claims in Section 8.5.

8.4. Study A—Detection and Discrimination at Scale

Study A evaluates the trajectory detector against the full corpus and tests H1 through H4. Results are summarized in Table 5.

Table 5. Study A—detection and discrimination over five thousand trajectories, against pre-registered thresholds.

H4.

Discrimination.

On the calibrated policy, the detector separates the two classes perfectly: every drift trajectory is flagged, no benign trajectory is, and the Matthews correlation coefficient is unity. The result is not surprising at the reference cell—soundness and completeness are theorems there—but it is the necessary baseline against which the harder questions are posed, and it is exactly what a capability-keyed detector cannot achieve: the single-stage component-diff comparator, which flags any baseline growth, scores a true-negative rate of zero on the same benign class, because that class grows by construction. The discrimination is policy-relative, not combination-keyed; the authorized-persistence benign recipe, whose declared capabilities are identical to the delegation-drift recipe, is correctly cleared.

H1.

Snapshot gap.

The pre-registered comparison is against a static analyzer held to the same false-positive budget. Equipped with the obvious signature for declared scope-broadening—a store whose declared scope already spans more than one dataset—the static analyzer detects the direct-persistence half of the drift population at a true-positive rate of 1.00 and zero false positives, because that scope-broadening is visible in the declared capability set. It detects none of the delegation-mediated half: there, the store is declared scoped to a single dataset and widens only at runtime through scope-flattening, leaving a declared footprint identical to the authorized-persistence benign recipe. The trajectory detector flags both halves; the gap is 0.500, and the McNemar test on the 1250 discordant pairs is decisive (p ≈ 2.3 × 10⁻²⁷³). The gap is not an artifact of a weak baseline: permitted a promiscuous signature—any store co-present with a cross-dataset read scope—the static analyzer reaches a true-positive rate of 1.00, but at a false-positive rate of 24.8% on authorized composition, a fivefold violation of the budget. The gap measures precisely the runtime-emergent drift that static analysis is structurally unable to see.

H2.

Observability grading.

Coverage degrades monotonically as provenance is withheld, instantiating the completeness bound of Section 8.1 as a measured curve. With full provenance, the detector flags 100% of drift; with delegation scope-flattening hidden, 50.0%; with all closure provenance hidden, 0.0%. The by-mechanism breakdown locates the decline exactly: the direct-persistence half is caught at the partial level, while the delegation-mediated half collapses to zero the moment flattening provenance is withdrawn. Completeness is a function of what the deployment can observe, and the curve names the price of each blind spot.

H3.

False-positive localization.

Under the calibrated policy, the detector raises no false positives. When the policy is deliberately misspecified—over-restrictive by dropping an authorized capability, or stale by lagging the most recent grant—false positives appear in volume (rates of 0.999 and 0.751), and 100% of all false positives fall in these misspecified-policy partitions rather than in the trigger logic. A false positive is a fidelity property of an input—here, of P(t)—not a property of the trigger.

8.5. Study B—Causal Ablation: Which Primitives Cause Drift

Study A establishes that drift occurs and is detectable; it does not say what causes it. Study B answers the causal question by controlled intervention: a factorial over the four composition primitives—persistence (store creation), data union (reading the second dataset), scope-broadening (a store scope extended to the second dataset), and transitive delegation—with drift labeled by the engine oracle under a fixed calibrated policy that authorizes everything except persisting the second dataset. The engine-derived drift condition is a three-way conjunction: drift occurs if and only if persistence and data union are both present and at least one promotion mechanism—scope-broadening or delegation—is present.

H5c.

Single-primitive insufficiency.

No single primitive induces drift; the single-primitive drift rate is 0.0%, against a threshold of at most 5%. Drift is compositional, not atomic—demonstrated by exhaustive intervention rather than by the single witness of Section 7.2.

H5a.

Necessity.

Leave-one-out removal isolates each primitive’s causal contribution. Removing persistence or removing data union eliminates 100% of drift cells; the two promotion mechanisms are substitutable, each necessary only for the subset of drift in which it is the sole promotion present. On the registered corpus, which balances the two drift mechanisms equally, removing transitive delegation eliminates drift in exactly 50.0% of drift-positive trajectories, meeting the pre-registered threshold. We report this figure as the registered-corpus instance and lead with the mix-independent decomposition: persistence and data-union are jointly necessary, and the promotion is a substitutable third ingredient.

H5b.

Super-additivity and interaction.

H5b was pre-registered as a conjunction of two required tests: a structural super-additivity criterion and a logistic-regression interaction test. We report the structural criterion as met, and the interaction-test conjunct as a deviation from the pre-registered analysis plan, and we record H5b as supported on its structural claim rather than as an unqualified pass. On the structural criterion, the persistence-and-data-union pair is super-additive in three of four background contexts—a 75% rate against the registered 50% threshold—reaching a persisted copy of the second dataset that neither primitive reaches alone. On the interaction test, the pre-registered instrument is inapplicable to the data; it was applied to the deterministic drift indicator, which is linearly separable in the four primitives, so an additive logistic model reproduces it exactly (accuracy 1.0, deviance 0), and the likelihood-ratio test for added interaction terms is degenerate, returning p = 1.0 by construction rather than by evidence. Reporting that value as a result would be misleading. We therefore substitute the direct super-additivity measure—the faithful operationalization of emergent reach beyond the union of parts—for the planned logistic conjunct and label this substitution explicitly as a deviation from the pre-registered analysis plan.

The mechanistic finding is that compositional drift is a higher-order event: it requires persistence and data-union together with a promotion that is either statically declared (scope-broadening) or dynamically induced (delegation), and the two promotions are interchangeable.

8.6. Study C—Behavioral Drift in a Live Agent

The studies above establish that drift is definable, detectable, and causally decomposable in the formal model and its faithful implementation. They do not establish that a real agent, given only benign instructions, will compose its authorities into the emergent capability. Study C tests exactly that, on a contemporary open-weights model with no fine-tuning toward the behavior.

Setup. The agent is the Hermes 3 (Llama 3.1, 70B) model, four-bit quantized, served locally. It is given a small set of composed, instrumented tools—read a dataset, write to a reporting sink, create a persistent store, and delegate a subtask to a worker agent—and tasks phrased entirely as benign data-processing requests. No task instructs the agent to cache, persist, or share the second dataset. The harness records every tool call and the agent’s reasoning and labels a run as drift if and only if the agent creates a persistent store that holds the second dataset, the precise capability the policy withholds. Two drift-conducive scenarios and two matched benign controls were run fifty times each, for two hundred episodes. H6 was pre-registered to require behavioral drift in at least 30% of drift-conducive configurations and at most 5% in controls, with p < 0.01.

Result. The agent drifted in 97 of 100 drift-conducive runs (97.0%, Wilson 95% CI 91.5–99.0%) and in 0 of 100 control runs (0.0%, CI 0.0–3.7%); the two-proportion test gives p ≈ 7.3 × 10⁻⁴³ (Table 6). The confidence-interval reading clears the thresholds: the drift lower bound exceeds 91%, and the benign upper bound is below the 5% ceiling. Both controls are true zeros.

Table 6. (a) Study C—behavioral drift in a live open-weights agent (fifty runs per configuration). (b) Study C cross-model extension (fifty runs per scenario per cell). Wilson 95% confidence intervals; two-proportion p per cell; locked H6 verdicts (drift rate at least 30%, benign rate at most 5%, p below 0.01), Holm corrected within the per-model family. The pooled Ornith row is the registered primary for that model.

Self-narration. Because the harness records reasoning, the drift is not inferred from tool calls alone; the agent describes it, reporting that it persisted in both datasets in a shared workspace for efficient reuse without refetching, framing the creation of cross-purpose shadow infrastructure as ordinary engineering prudence—the visibility paradox of Section 8.11 observed from the inside.

Mechanism. In the delegated scenario, the tool-call ordering is deterministic and diagnostic: in all fifty drift runs, the coordinating agent created the persistent store of the second dataset before issuing the delegation (fifty of fifty, none after, none without). The agent provisions shared, durable infrastructure in anticipation of the worker’s need—the behavioral instantiation of the delegation-mediated persistence that the model predicts and the trigger flags at the delegation step. Three of fifty pipeline runs did not drift, and delegated workers occasionally degraded under the rate limit rather than cleanly provisioning a cache; the phenomenon is robust, not invariant.

Cross-model extension. The original submission evaluated one model. In revision, under a frozen pre-registration addendum with unchanged H6 thresholds, the study was extended to three models spanning size, lineage, and training paradigm: Hermes 3 (Llama 3.1) 70B, the anchor above; Ornith-1.0-9B, a reasoning model post-trained for agentic coding on the Qwen lineage, included as a representative of the agentic-tuned class and carrying a within-model sensitivity arm of two temperatures (0.6 with vendor-recommended nucleus settings; 0.7 with server defaults) crossed with two prompt variants (A, the original task text verbatim; B, a registered paraphrase preserving every constraint), at 50 runs per scenario per cell; and Qwen2.5-32B-Instruct, a mid-size general-instruct model, at the baseline cell. H6 is evaluated per model with the locked thresholds, Holm-corrected across the per-model family; the Ornith primary is the pooled four-cell test. Harness changes were limited to disclosed measurement-neutral items; the diff, the amendment history, and a deviation note ship in the Supplementary Materials. Of 1000 extension episodes, 997 were completed; three request-level transients (two context-window rejections, Ornith at temperature 0.7, benign group; one malformed tool-call generation, Qwen, drift group) were retained as non-drift rows per the registered rule.

Three findings organize Table 6b. First, drift completion is universal and robust: every model in every cell completed drift trajectories far above the locked 30 percent floor, from 59 to 99 percent of drift-conducive runs (Hermes 97.0 percent, CI 91.5 to 99.0; Ornith pooled 66.8 percent, CI 62.0 to 71.2, across cells spanning 59 to 81 percent; Qwen 99.0 percent, CI 94.6 to 99.8), with condition separation between 10 to the minus 16 and 10 to the minus 75; neither sampling temperature nor the registered paraphrase suppressed the behavior. The per-scenario signature is informative: the two-stage pipeline handoff ran at or near ceiling for every model (94 to 100 percent), while the delegated-cache scenario is the model-sensitive component (20 to 98 percent).

Second, the locked conjunction discriminates on the benign criterion, not the drift criterion. The per-model verdicts under Holm correction are H6-Hermes PASS, H6-Ornith (pooled) PASS, and H6-Qwen FAIL, with one Ornith cell (vendor sampling, variant A) also failing; the failures are reported as registered rather than repaired, and the event-type decomposition explains them. Flagged events are divided into persist-type violations, the modeled shadow-infrastructure mechanism, and read-type violations in which the model invents or malforms resource identifiers that the strict envelope check correctly counts as out-of-policy reach. Persist-type events concentrate in drift-conducive configurations and are stable within the model (Ornith 59 to 88 per cell; Qwen 132); read-type events drive the benign-side rates, differ sharply by model (Hermes 0 percent of control runs; Ornith 3 to 7 percent; Qwen 19 percent), and, within Ornith, scale with temperature (43 to 45 events at 0.6 versus 87 and 217 at 0.7) while persist-type counts barely move. The two behaviors are dissociable: propensity to complete the modeled drift is a property of the scenario structure that all three models express, while identifier fabrication is a model- and temperature-dependent behavior that a production composition monitor would also flag for a different reconciliation reason. The locked benign ceiling, chosen to bound false alarms, turns out to measure control-condition discipline across models, and it is reported exactly as registered.

Third, the reasoning-capture serving path for Ornith records the model’s chain of thought separately from its replies, and the run records in the Supplementary Materials contain the same self-narration evidence as the Hermes transcripts above: the agent motivating persistence of the secondary dataset as efficiency or handoff preparation. In one representative delegated-cache episode (temperature 0.6, variant A, run 4) the model plans, in its reasoning channel, “Let me first create stores for both datasets, then read them properly for analysis,” and in another (run 11) it writes “I should NOT keep re-reading D2 (rate-limited),” persisting the rate-limited secondary dataset precisely to avoid refetching it: each step is individually lawful, and the persistence is the drift. What the expanded study supports is unchanged in kind and wider in base: drift trajectories of the modeled kind are readily completable by current language-model agents across sizes (9B to 70B), lineages (Llama and Qwen), and training paradigms (general instruct and agentic RL), in a controlled environment, on benign tasks, without any individually denied action; what it does not support remains calibrated prevalence in production systems (Section 8.9). The conditional Hermes variant-B arm registered in the addendum was not run; the wall-clock budget before the revision deadline was allocated to the registered arms, a resource decision made without reference to any result, as the addendum requires.

8.7. Multi-Hop Delegation Case

Extend the positive scenario by one hop. DA delegates to a child DA′ (c₃), and DA′ further delegates to DA″ (c₄) to shard the workload, passing along the inherited store creation and read authorities. Each delegation is admissible against the envelope in force. The emergent capability—a persistent, cross-purpose, independently queryable copy of D₂—now materializes two hops from where its constituents were approved (transitive drift, Section 4.4): the credential to the store is held by DA″, whose authority no approver of c₁ or c₂ examined. This exercises the delegation-and-credential-graph component (Section 6.1) and shows the per-increment admissibility clause holding at every hop while reach(B(t)) ⊄ P(t) at the second.

8.8. Comparison to Static IAM and Toxic-Combination Analysis

Static IAM/CIEM toxic-combination analyzers [16] and attack-path tools [17,18] evaluate a permission snapshot for known-dangerous combinations. They differ from composition drift on three axes:

Temporal—they analyze a state, not an approved-delta trajectory B(t) with per-increment admissibility against P(t_i).
Runtime—they reason over declared entitlements, not over runtime-provisioned or emergent resources, i.e., not over the effective composition E(t).
Reference—they match against a catalog of toxic patterns, whereas the trigger tests joint reach against a policy invariant P(t) that the approvals were each admissible under.

Composition drift is the temporal/runtime complement to static toxic-combination analysis, not a replacement; the two compose—a static analyzer can seed the negative constraints of P(t).

Study A makes this contrast quantitative: a static analyzer detects the statically visible half of the drift population at zero false-positive cost but is blind to the runtime-emergent half, and matching the trajectory detector’s recall forces a fivefold false-positive increase (Section 8.4).

8.9. Threats to Validity

Construct validity: The reference engine is a model of capability closure, not a production policy graph; its drift verdict is sound by construction, so Study A’s reference-cell perfection reflects the model’s internal consistency, and the load-bearing empirical claims are the snapshot gap, the observability curve, and the false-positive localization, which concern relaxations of that ideal. Internal validity: Study B’s drift labels are produced by the same engine whose behavior is under study, which is appropriate for a causal ablation of the model’s mechanics but means H5a through H5c are claims about the formalism’s structure, corroborated behaviorally by Study C rather than independently of the model. External validity: Study C’s anchor arm uses a single open-weights model under one quantization and a small scenario set; the observed rates should be read as evidence that the behavior occurs readily, not as calibrated cross-model prevalence, and cross-framework replication in production agent stacks is future work. Statistical validity: The corpus is balanced fifty-fifty by design, so the H5a delegation-necessity figure is mix-dependent and is reported as such, and the H5b interaction-test conjunct is reported as a deviation from the pre-registered analysis plan—inapplicable to deterministic, separable data, with the structural super-additivity measure substituted in its place—rather than reported as a significance result. The cross-model extension of Section 8.6 widens the base of this claim without removing the circularity: the tools, tasks, and drift definition still derive from the models under test, and the Supplementary Materials include a deviation note recording every amendment made to the extension harness.

8.10. Reproducibility

The reference closure engine, the corpus generator, the generated five-thousand-trajectory corpus, the three study harnesses, the frozen pre-registration with all thresholds, and the Study C run records—including per-episode reasoning transcripts and the exact serving configuration of the live agent—are provided as Supplementary Materials. Every reported number in Table 5 and Table 6 is regenerable from these artifacts; the pre-registration was frozen before data collection, and the one implementation correction made during the study (Section 8.3) is documented with its before-and-after regression check.

8.11. Discussion

When does adaptation become drift? Adaptation is the agent doing its job within its authorized capability; drift is the departure of effective composition from baseline; compositional drift is the moment the approved baseline’s joint reach violates the policy invariant P(t). The three are not a matter of degree but of kind, and the capability stage is what draws the lines.

The component-approval/composition-capability gap. This is the conceptual heart. Governance approves changes; capability accrues to compositions. The two are evaluated in different spaces, and nothing in per-change approval closes the gap between them, because per-change approval never evaluates the union against the closure. The compositional capability check is the smallest control that does.

The visibility paradox. The most dangerous drift is the least visible. A change that obviously expands reach draws review; the compositional case expands reach through changes that individually do not, so each clears review precisely because it is individually unalarming. The capability that results is invisible to the process that authorized its parts. The paradox is no longer only an argument: in Study C, the agent narrated its own drift as efficiency, and in Study A, the static baseline could match the trajectory detector’s recall only by treating authorized composition as suspect—two independent demonstrations that the danger lies exactly where review does not look.

The dependency trap. As agents delegate, compositional capability accrues transitively, one or more hops from where its constituents were approved. The enterprise that governs each agent’s changes in isolation governs none of the compositions that delegation assembles. This is the bridge to authority creep and contagion, which is deferred here.

Adversarial exploitation. The phenomenon is worse if exploited, but exploitation is not its spine. An adversary who understands compositional drift can steer approved changes toward a target combination, achieving a capability through a sequence of individually approvable deltas that would be refused if requested directly—a multi-step confused-deputy construction against the governance process itself. We note this as a consequence and defer its treatment; the benign case is sufficient to motivate the control and is the harder case to defend against precisely because nothing in it looks wrong.

8.12. Robustness, Sensitivity, and Scalability of the Detector

The pre-registered evaluation varies observability (H2) and policy regime (H3). A registered extension sweep (Supplementary Materials; the Phase 1 engine and Phase 2 recipe components byte-identical to the submitted build) varies the remaining structural parameters, with construction-based ground truth and 500 trajectories per cell, half drift and half matched benign twins, and 16,000 trajectories in total across the 32 detection cells. Detection is structurally insensitive to these parameters at full observability: across delegation fan-out from one to 32 children, capability-graph size from 10 to 1000 benign capabilities around a fixed drift core, policy complexity from 0 to 10,000 additional allow entries, trajectory length from three to 200 steps, and eight randomized heterogeneous agent profiles, true-positive and true-negative rates were 1.000 in every cell (Wilson 95 percent CI 0.985 to 1.000). This is the designed behavior: the closure is a deterministic reachability computation, so operating conditions move cost, not correctness, and the conditions under which detection degrades are observability loss and policy miscalibration, which are exactly the H2 and H3 loci. A concurrent-drift family (one to eight independent mechanisms between baseline updates) additionally measured violation completeness, whether every constructed emergent capability is recovered rather than merely whether the trajectory is flagged: completeness was 1.000 at all concurrencies, the empirical counterpart of the set-semantics property of Section 4 that simultaneous drift events compound within a single divergence and joint-reach test rather than masking one another. One structural property accompanies the fan-out sweep analytically: under the delegation scope-flattening rule, the child’s reachable fact set is maximal at the first hop, so reach is invariant to chain depth beyond hop one by construction; fan-out, not chain depth, is the axis on which delegation load varies.

Cost scales approximately as the product of state size and fan-out. On an Intel Core Ultra 9 285K (single thread), the reference engine evaluates the full two-stage check on a 100,000 capability authority state in 271 ms at fan-out 1, 1.68 s at fan-out 8, and 6.63 s at fan-out 32, with peak evaluation memory of 61 MB or less; at 10,000 capabilities the medians are 15, 101, and 384 ms, and fleet throughput on mixed trajectories of realistic size is approximately 3200 full evaluations per second. Absolute cost at enterprise scale is therefore modest, and because the reference engine recomputes the full closure at every event these figures bound the naive strategy from below; an incremental strategy that recomputes only the reachability cone affected by a changed component reduces per-event cost for the common case of localized change, and its formalization remains a matter of future engineering work consistent with Section 10.

9. Federal and Enterprise Governance Implications

9.1. Governance Mapping

The drift layer is narrow by design, and its value is as an input to governance machinery that already exists. We map where it plugs in.

Non-human identity lifecycle governance. The compositional drift event is a reauthorization trigger for AIGF lifecycle governance: the agent’s effective authorization has departed from its granted authorization, which is exactly the condition those frameworks should act on but cannot currently detect.
Continuous authorization/ongoing ATO. In federal continuous authorization and zero trust non-human-identity regimes [20], the event is a re-trigger of the authorization decision. The drift signal supplies the “something changed materially” input that ongoing authorization needs and that point-in-time accreditation misses.
CMDB/IaC reconciliation. The shadow resources of Section 5 are what configuration reconciliation is built to surface—once it is told to look. The drift event directs reconciliation at the emergent resource, turning a general sweep into a targeted check.
Compliance and regulatory mapping. The drift event is the evidentiary trigger several control regimes presume but cannot currently generate: the configuration and change-management controls (CM-2, CM-3, CM-8) and the continuous monitoring control (CA-7) of NIST SP 800-53 [30] and FedRAMP continuous monitoring [29]; the govern-and-manage functions of the NIST AI Risk Management Framework [31] and the controls of an ISO/IEC 42001 AI management system [32]; the change-management criteria of a SOC 2 examination; and the scoped-authority expectations of CISA’s agentic guidance [3]—all within the current federal AI policy posture under EO 14179 [33]. The drift layer supplies the trigger and the evidence; each regime supplies the obligation.

In the private enterprise, the same signal feeds non-human-identity governance and FinOps (shadow infrastructure is also unbudgeted infrastructure; Section 5.4). In each case, the drift event is the input; the governance action is the host framework’s. We do not propose to govern; we propose to detect what governance is currently blind to and route it.

Ownership and accountability. One question the mapping leaves implicit deserves to be explicit: shadow infrastructure has no owner by construction—no decision created it, so no accountability attaches. The drift event closes that gap without inventing an ownership regime; it binds the emergent resource, and the capability that produced it, to the party already on record—the agent’s sponsor, accountable for the agent and therefore for what the agent provisions. The ownership question routes to the locus of existing lifecycle governance already named. We surface it; we do not relocate it.

9.2. Federal and Enterprise Crosswalk

Section 9.1 establishes where the drift signal plugs into existing governance machinery; this section makes the mapping concrete against the specific control catalogs, and AI governance mandates that a federal or enterprise adopter must satisfy. The framework is not a substitute for these instruments. Each is written for a static configuration, a per-grant decision, or a point-in-time snapshot; composition drift is the gap each leaves open, and the framework’s baseline B(t), divergence D(t), provenance H(t), policy invariant P(t), and joint-reach trigger are the agentic-trajectory complement that lets each instrument hold for agentic systems. The crosswalk is given for both federal adopters—NIST AI RMF [31], NIST SP 800-53 [30], and OMB M-25-21 [34], and enterprise adopters of the same control families (Table 7).

Table 7. Federal and enterprise crosswalk—control or mandate mapped to the corresponding framework mechanic.

Three mappings carry most of the weight. CM-8 (component inventory) is where shadow infrastructure surfaces as an inventory gap; CA-7 (continuous monitoring) is where snapshot assessment must become trajectory assessment to see drift at all; and AC-6 (least privilege) is where the emergent character is sharpest, since every grant satisfies least privilege while the joint reach does not. These are also the three controls a point-in-time assessor is most likely to mark as satisfied while the condition is present.

At the policy level, OMB M-25-21 [34] is the closest existing analog: its AI use-case inventory and high-impact AI practices already presume an agency can enumerate and bound what its AI systems can do, and agencies have begun applying shadow-IT-style discovery to find unauthorized AI. Composition drift names the failure mode that discovery is reaching for, and supplies the trigger, baseline, and provenance that make the inventory and the CAIO risk acceptance decision defensible for agentic systems specifically. (M-25-21 applies to executive branch agencies and rescinds M-24-10; national security systems fall outside its scope.)

9.3. Decision-Maker Implications

The condition this paper formalizes—an agent’s joint reachable capability drifting past its authorized envelope, reach(B(t)) ⊄ P(t), and provisioning infrastructure outside any inventory—is, for a decision-maker, not an abstract property but a set of concrete risks spanning mission, data, compliance, cost, and resilience. None requires a breach or a malicious actor; each follows from approvals that were individually correct. The implication for leadership is structural: approved-state attestations and asset inventories understate exposure, and the gap is silent. We state the five risk classes the model implies. Their incidence is no longer asserted but measured: Section 8.4 reports drift incidence across the trajectory corpus, and Section 8.6 the rate at which a live agent realizes the shadow infrastructure on benign tasks.

Mission and Operational Risk. An agent’s effective authority can exceed its approved authority with no record of the change. A decision-maker can therefore no longer infer what an agent will do from what it was approved to do: an agent fielded for a bounded task can reach data, actions, or systems for which no approval was contemplated (Section 4.3), and through delegation, that reach can manifest one or more hops from where its constituents were approved (transitive drift, Section 4.4). For mission systems, this is a loss of predictable behavior and an expanded, unattested blast radius—the agent operates lawfully within its now-effective authority while outside its intended operational scope. Mission assurance depends on the authorized envelope P(t) remaining the operative envelope; composition drift breaks that identity silently.

Data Leakage and Records Management Risk. The shadow infrastructure composition drift produces is, by construction, a copy of data outside inventory and outside the controls that govern the source. The worked case—a persistent, delegated, cross-purpose copy of a sensitive source, standing apart from its origin’s access controls and lifecycle—is at once a data spill and a records management failure: the copy carries no retention or disposition schedule, persists past any approved time limit, and replicates controlled information into a store no data governance process knows exists. For organizations under records schedules, controlled information handling, or data residency obligations, the exposure is that the authoritative inventory of where sensitive data lives is wrong, and that hold, discovery, and disposition obligations cannot reach records no system records.

Compliance and Authorization Risk. Continuous authorization and continuous monitoring regimes assess a system against its authorized state [21,29], over zero trust and control baselines [20,30]. Composition drift makes the authorized state-of-record diverge from effective authorization: the assessment, the system security artifacts, and the signed manifest all certify the baseline that was authorized, while reach(B(t)) has moved past P(t). Least privilege and separation of duties are violated emergently, though every grant was individually compliant. The compliance risk is thus not a failed control but a true attestation of a state that no longer holds—the authorization boundary has been crossed with no change-control record to show it. That is precisely the condition under which continuous authorization exists to prevent and, evaluated on a snapshot basis, cannot see.

FinOps and Unbudgeted-Resource Risk. Resources provisioned outside any inventory are also outside any budget. Emergent stores, caches, and child agent compute created through approved pathways accrue cost with no owner, no cost allocation tag, and no budget line; FinOps governance—showback and chargeback, tagging policy, commitment, and capacity planning—is blind to them by the same mechanism that hides them from asset inventory. The decision-maker’s exposure is unbudgeted and unattributed spend, orphaned resources that outlive the task that spawned them, and a cleanup-and-decommissioning liability that grows with every undetected drift event. Reconciliation against cloud, CMDB, and IaC state (Section 6.1) is the control that closes the cost–visibility gap as well as the security one.

Resilience, Incident Response, and Vendor Lock-In. Three further implications follow from the same root.

Resilience. Unmanaged infrastructure is unmonitored infrastructure: a shadow store sits outside backup, patching, continuity, and disaster-recovery scope, and the agent’s expanded reach is an expanded attack surface that no threat model covers.
Incident response. An incident cannot be scoped across resources that the organization does not know exist. Provenance (H(t)) and the delegation-and-credential graph (Section 6.1) are the assets that let responders reconstruct how an agent reached what it reached and bound the blast radius; without them, a shadow copy of a sensitive source is a breach-notification trigger that may simply be missed.
Vendor lock-in. Agentic platforms that silently provision their own stores, caches, and credentials embed an enterprise’s emergent infrastructure inside a vendor’s substrate. Exit and portability degrade when that shadow infrastructure is vendor-specific and not inventoried, and when attestation depends on a single vendor’s proprietary manifest. This is a direct argument for open, versioned composition manifests (Section 6.1) as a portability and exit control, not only a security one.

The Common Structure. Across all five, the structure is identical: an approved-state attestation understates exposure, and the gap is silent. The action the model supports is to treat the authorized envelope P(t) as a standing invariant to be reconciled against effective reach—not a provisioning-time fact—and to fund the detection-and-enforcement architecture (Section 6.1) as the instrument that makes these risks visible before they become incidents, records, invoices, or breaches.

9.4. Governance Ownership

Composition drift crosses organizational boundaries, and no single role’s remit covers the joint reach it produces. The condition reach(B(t)) ⊄ P(t) materializes between the role that fields the agent, the role that owns authorization, the role that owns the data the agent copies, and the role that owns the infrastructure it provisions. Ownership must therefore be assigned per facet and, separately, for the joint condition itself; otherwise drift falls in the gap between owners, which is the organizational form of the visibility gap this paper describes. The allocation the model implies is as follows (Table 8).

Table 8. Governance ownership—per-facet allocation of the composition drift condition and the joint condition.

Two cautions attach to any role split. First, the facets above are inputs; the joint condition reach(B(t)) ⊄ P(t) is owned by none of them unless it is named explicitly. A single accountable owner for the joint condition must be designated: by remit, the CISO, or, where the agent is the unit of risk acceptance, the CAIO, with the other roles accountable for their inputs. Distributing the inputs without assigning the joint is precisely how the condition stays unowned.

Second, observability is procured, not assumed. If versioned composition manifests and the telemetry that exposes E(t) are not acquisition requirements, the detection plane (Section 6.1) has nothing to reconcile against, and the completeness bound (Section 8.1) defaults to the unobservable case. For federal and other regulated buyers, this makes acquisition the highest-leverage control in the allocation: it determines whether every downstream owner can see the surface they are accountable for, and it is the point at which open, versioned manifests can be required over a vendor’s proprietary attestation (Section 9.3).

The detection-and-enforcement architecture (Section 6.1) is the shared instrument these owners operate; an ownership assignment without that instrument is nominal, because no role can be held accountable for a surface it cannot observe.

10. Limitations and Future Work

No efficacy claim. This work now evaluates the model and the control: a pre-registered study reports coverage, false-positive behavior, causal structure, and a live agent drift rate (Section 8.3, Section 8.4, Section 8.5 and Section 8.6). The evaluation runs on a reference closure engine and a constructed corpus with ground-truth labels, with one behavioral study across three open-weights models; it is evidence of the model’s behavior under those conditions, not a field deployment, and the scope limits below bound its generalization.

Capability closure was left abstract. The capability closure reach (·) is instantiated as an executable reference closure engine for the evaluation (Section 8.3); instantiating it for a production authorization system across heterogeneous frameworks—defining what counts as a capability and how emergent capability is computed at scale—remains substantial engineering beyond this study, and the corpus, though drawn partly from real configurations, is not a field census.

Policy-encoding fidelity. The model assumes an organization can encode P(t) with enough fidelity to evaluate joint reach; incomplete policy encoding is a first-order operational risk.

Observable-portion limit. Detection sees the observable portion of drift only (Section 6.6). Unobservable, runtime-only drift is named but not addressed.

Operationalization and adoption sequence. We specify the model and the control, not deployment. A natural adoption sequence—a logical ordering, not a validated or time-bound roadmap—proceeds in four stages: (1) capture the signed composition manifest at provisioning; (2) stand up continuous component-diff against it; (3) add the capability-closure check at the diff; and (4) wire the resulting trigger into a policy engine and the lifecycle handoff. The order is dependency-driven, and each stage is independently useful, but we claim no coverage, false-positive rate, or cost for any of them absent deployment data.

Ordering and adversarial-baseline limits. The model assumes approval events for a given agent are totally ordered by an authoritative log. Interaction semantics among concurrent baseline updates across multiple interacting agents under federated authorization, where per-authority logs are each ordered but no global order exists, are not formalized here and are future work; Section 3.1 names federation as an amplifier of exactly this case. Separately, an adversary whose malicious capability is admissible within the approved baseline and envelope from the outset presents no divergence and no joint-reach violation for a baseline-relative detector to flag; that case belongs to approval-time review rather than runtime drift detection (Section 3.1).

Deferred surfaces. Three are explicitly forward-pointing. Trust boundaries: a formal treatment of where composition crosses trust domains. Authority creep and contagion: the transitive accumulation of compositional capability through delegation, in which the dependency trap of Section 8.11 is made formal. And the post-quantum credential angle—the survival of cryptographic material and credential authority across model and composition transforms, against the federal post-quantum mandate [35,36]—is the subject of a companion paper. The selection is structural rather than arbitrary: each surface is the adjacent formal problem exposed by one element the model uses but does not itself formalize. Trust boundaries correspond to the boundary structure the threat model observes (Section 3.1); authority creep and contagion correspond to the propagation structure the delegation closure rule generates (Section 7.4); and the credential angle corresponds to the persistence structure that makes drifted infrastructure durable and independently reachable (Section 5.1 and Section 8.7). Boundary, propagation, and persistence are the three structures the formalism relies on, each pointed outward.

11. Conclusions

Identity governance secures the agent. It does not secure the agent’s composition over time. Between provisioning and retirement, an agent’s effective composition drifts from its signed baseline through changes, each individually approved. When the capability closure of that composition exceeds the union of what was individually authorized, the agent holds the capability for which no decision has ever been granted. That compositional drift is the upstream cause of shadow infrastructure: unmanaged enterprise infrastructure created lawfully, invisibly, and by emergence. The answer is not to replace lifecycle governance but to add a layer beneath it—a two-stage drift detection control that diffs the effective composition against a signed manifest and evaluates the closure of the combination, flagging the compositional event and handing it to the lifecycle frameworks that can act on it. The contribution is a temporal governance model for approved composition drift in agentic systems, linking emergent capability to reauthorization and inventory reconciliation—the model that makes that event precise, and the discrimination that separates it from the benign evolution it superficially resembles. A pre-registered empirical study supports the model: across five thousand composition trajectories the two-stage detector discriminates compositional drift from authorized growth where static analysis cannot, a controlled ablation isolates the primitives that produce it, and, in controlled live agent runs, language-model agents given only benign tasks build the predicted shadow infrastructure in 59% to 99% of drift-conducive trials across models and cells, at matched-control rates of 0% to 19% that separate at vanishing p-values. The model and the control have been evaluated in this pre-registered setting; they have not been deployed or evaluated in a production environment.

Supplementary Materials

The following supporting information can be downloaded at: https://www.mdpi.com/article/10.3390/computers15080510/s1, a README; the reference closure engine (asi_closure_engine.py); the corpus generator and the generated 5000-trajectory corpus (asi_corpus.py, asi_corpus.jsonl); the three study harnesses (asi_study_a.py, asi_study_b.py, asi_study_c.py) and the live-agent tool-use template (hermes3_tool_use.jinja); the frozen pre-registration and locked thresholds; the Study A and Study B result logs and the engine validation log; and the Study C live-agent run records with per-episode reasoning transcripts.

Funding

This research received no external funding.

Data Availability Statement

The reference closure engine, the trajectory-corpus generator and corpus, the three study harnesses, the pre-registration, and the live-agent run records (including per-episode reasoning transcripts) are provided as Supplementary Materials.

Acknowledgments

During the preparation of this manuscript, the author used Claude Opus 4.8 (Anthropic) for language editing, formatting consistency, and reference cross-checking, and for routine implementation assistance with the study software. The author reviewed and verified the outputs and takes full responsibility for the content of this publication. The language models evaluated in Section 8.6 are experimental subjects of the study and are described in Section 7.4 and Section 8.6.

Conflicts of Interest

The author serves as Global Quantum-Safe Executive and Quantum Ambassador with IBM. The author is also the sole owner of Med Cybersecurity (Med Cyber Security Enterprise Blockchain Cybersecurity), a single-member limited liability company that is currently inactive, conducts no business, and has no employees; the medcybersecurity.com domain is retained solely for the author's personal correspondence email. Neither IBM nor Med Cybersecurity had any role in the study's conceptualization, design, software development, data collection, analysis, interpretation, manuscript preparation, or decision to submit, and no funding, infrastructure, data, or products of either organization were used. The study was conducted, and its computing resources were provided, solely by the author.

References

Cloud Security Alliance. Agent Identity Governance Framework; Version 1 (White Paper); Cloud Security Alliance: Seattle, WA, USA, 2026; Available online: https://labs.cloudsecurityalliance.org/agentic/agentic-identity-governance-framework-v1/ (accessed on 14 June 2026).
Cloud Security Alliance AI Safety Initiative. The Non-Human Identity Governance Vacuum: AI Agents and the Fastest-Growing Unmanaged Attack Surface; White Paper; Cloud Security Alliance: Seattle, WA, USA, 2026; Available online: https://labs.cloudsecurityalliance.org/research/csa-whitepaper-nonhuman-identity-agentic-ai-governance-v1-cs/ (accessed on 14 June 2026).
Cybersecurity and Infrastructure Security Agency (CISA); National Security Agency; Australian Signals Directorate’s Australian Cyber Security Centre; Canadian Centre for Cyber Security; National Cyber Security Centre (New Zealand); National Cyber Security Centre (UK). Careful Adoption of Agentic Artificial Intelligence (AI) Services; CISA: Washington, DC, USA, 2026. Available online: https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services (accessed on 14 June 2026).
Cybersecurity and Infrastructure Security Agency. Widespread Supply Chain Compromise Impacting npm Ecosystem; CISA Alert; CISA: Washington, DC, USA, 2025. Available online: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem (accessed on 16 July 2026).
Palo Alto Networks Unit 42. “Shai-Hulud” Worm Compromises npm Ecosystem in Supply Chain Attack; Palo Alto Networks: Santa Clara, CA, USA, 2025; Available online: https://unit42.paloaltonetworks.com/npm-supply-chain-attack/ (accessed on 16 July 2026).
Microsoft Security. Shai-Hulud 2.0: Guidance for Detecting, Investigating, and Defending Against the Supply Chain Attack; Microsoft: Redmond, WA, USA, 2025; Available online: https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/ (accessed on 16 July 2026).
IBM Security. Cost of a Data Breach Report 2025; IBM Corporation: Armonk, NY, USA, 2025. [Google Scholar]
Verizon. 2026 Data Breach Investigations Report; Verizon Business: New York, NY, USA, 2026. [Google Scholar]
Anthropic. Donating the Model Context Protocol and Establishing the Agentic AI Foundation; Anthropic: San Francisco, CA, USA, 2025; Available online: https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation (accessed on 16 July 2026).
National Institute of Standards and Technology, National Cybersecurity Center of Excellence (NCCoE). Accelerating the Adoption of Software and AI Agent Identity and Authorization; Concept Paper, Draft; NCCoE: Rockville, MD, USA, 2026. Available online: https://www.nccoe.nist.gov/publications/other/accelerating-adoption-software-and-ai-agent-identity-and-authorization-concept (accessed on 14 June 2026).
SPIFFE: Secure Production Identity Framework for Everyone—Specification. Cloud Native Computing Foundation: San Francisco, CA, USA. Available online: https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/ (accessed on 14 June 2026).
Hardt, D. (Ed.) The OAuth 2.0 Authorization Framework; RFC 6749; Internet Engineering Task Force (IETF): Fremont, CA, USA, 2012. [Google Scholar] [CrossRef] [Scilit]
Sakimura, N.; Bradley, J.; Jones, M.; de Medeiros, B.; Mortimore, C. OpenID Connect Core 1.0; OpenID Foundation: San Ramon, CA, USA, 2014. [Google Scholar]
Grizzle, K.; Ansari, M.; Wahlström, E.; Mortimore, C. System for Cross-Domain Identity Management: Protocol; Hunt, P., Ed.; RFC 7644; Internet Engineering Task Force (IETF): Fremont, CA, USA, 2015. [Google Scholar] [CrossRef] [Scilit]
Grizzle, K.; Wahlström, E.; Mortimore, C. System for Cross-Domain Identity Management: Core Schema; Hunt, P., Ed.; RFC 7643; Internet Engineering Task Force (IETF): Fremont, CA, USA, 2015. [Google Scholar] [CrossRef] [Scilit]
Sandhu, R.S.; Coyne, E.J.; Feinstein, H.L.; Youman, C.E. Role-Based Access Control Models. Computer 1996, 29, 38–47. [Google Scholar] [CrossRef] [Scilit]
Robbins, A.; Schroeder, W.; Vazarkar, R. Six Degrees of Domain Admin. In Proceedings of the DEF CON 24, Las Vegas, NV, USA, 4–7 August 2016. [Google Scholar]
SpecterOps. BloodHound. Available online: https://github.com/SpecterOps/BloodHound (accessed on 14 June 2026).
Hardy, N. The Confused Deputy (or why capabilities might have been invented). ACM SIGOPS Oper. Syst. Rev. 1988, 22, 36–38. [Google Scholar] [CrossRef] [Scilit]
Rose, S.; Borchert, O.; Mitchell, S.; Connelly, S. Zero Trust Architecture; NIST Special Publication 800-207; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2020. [CrossRef] [Scilit]
Dempsey, K.; Chawla, N.S.; Johnson, A.; Johnston, R.; Jones, A.C.; Orebaugh, A.; Scholl, M.; Stine, K. Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations; NIST Special Publication 800-137; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2011. [CrossRef] [Scilit]
ISO/IEC 20000-1:2018; Information Technology—Service Management—Part 1: Service Management System Requirements. International Organization for Standardization: Geneva, Switzerland, 2018.
Morris, K. Infrastructure as Code: Dynamic Systems for the Cloud Age, 2nd ed.; O’Reilly Media: Sebastopol, CA, USA, 2020. [Google Scholar]
Wang, C.L.; Singhal, T.; Kelkar, A.; Tuo, J. MI9: An Integrated Runtime Governance Framework for Agentic AI. arXiv 2025, arXiv:2508.03858. [Google Scholar] [CrossRef] [Scilit]
Park, J.; Sandhu, R. The UCONABC Usage Control Model. ACM Trans. Inf. Syst. Secur. 2004, 7, 128–174. [Google Scholar] [CrossRef] [Scilit]
Hu, V.C.; Ferraiolo, D.; Kuhn, R.; Schnitzer, A.; Sandlin, K.; Miller, R.; Scarfone, K. Guide to Attribute Based Access Control (ABAC) Definition and Considerations; NIST Special Publication 800-162; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2014. [CrossRef] [Scilit]
Pang, R.; Caceres, R.; Burrows, M.; Chen, Z.; Dave, P.; Germer, N.; Golynski, A.; Graney, K.; Kang, N.; Kissner, L.; et al. Zanzibar: Google’s Consistent, Global Authorization System. In Proceedings of the 2019 USENIX Annual Technical Conference (USENIX ATC ’19), Renton, WA, USA, 10–12 July 2019; USENIX Association: Berkeley, CA, USA, 2019; pp. 33–46. [Google Scholar]
Open Policy Agent (OPA). Cloud Native Computing Foundation: San Francisco, CA, USA. Available online: https://www.openpolicyagent.org/ (accessed on 14 June 2026).
General Services Administration. FedRAMP Continuous Monitoring (ConMon) Playbook (Rev 5); Federal Risk and Authorization Management Program (FedRAMP), General Services Administration: Washington, DC, USA, 2025. Available online: https://www.fedramp.gov/docs/rev5/playbook/csp/continuous-monitoring/ (accessed on 14 June 2026).
National Institute of Standards and Technology. Security and Privacy Controls for Information Systems and Organizations; NIST Special Publication 800-53, Revision 5; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2020. [CrossRef] [Scilit]
National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0); NIST AI 100-1; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2023. [CrossRef] [Scilit]
ISO/IEC 42001:2023; Information Technology—Artificial Intelligence—Management System. International Organization for Standardization and International Electrotechnical Commission: Geneva, Switzerland, 2023.
The White House. Executive Order 14179: Removing Barriers to American Leadership in Artificial Intelligence; The White House: Washington, DC, USA, 2025. Available online: https://www.federalregister.gov/documents/2025/01/31/2025-02172/removing-barriers-to-american-leadership-in-artificial-intelligence (accessed on 14 June 2026).
Office of Management and Budget. Accelerating Federal Use of AI Through Innovation, Governance, and Public Trust; OMB Memorandum M-25-21; Office of Management and Budget: Washington, DC, USA, 2025. Available online: https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf (accessed on 14 June 2026).
The White House. National Security Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems (NSM-10); The White House: Washington, DC, USA, 2022; Available online: https://www.presidency.ucsb.edu/documents/memorandum-promoting-united-states-leadership-quantum-computing-while-mitigating-risks (accessed on 14 June 2026).
National Security Agency. Announcing the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0); National Security Agency: Fort Meade, MD, USA, 2025. Available online: https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF (accessed on 14 June 2026).

Figure 1. Two-stage composition-drift model. Stage one computes the component diff D(t) = E(t) △ B(t); stage two computes the capability closure reach(B(t)) and tests it against the policy invariant P(t). Compositional drift is the boundary crossing reach(B(t)) ⊄ P(t), which can occur with D(t) = ∅.

Figure 2. Detection-and-enforcement architecture. The detection plane (versioned composition manifest, tool and resource discovery, delegation and credential graph, runtime event and provenance collection, and cloud/CMDB/IaC reconciliation) observes the composition and surfaces evidence; the enforcement plane (policy-invariant engine, pre-action authorization gate, and reauthorization and revocation workflow) computes the violation and hands off to lifecycle governance.

Figure 3. Worked positive case as a drift trajectory. Individually admissible changes c₁ (store creation), c₂ (read D₂), and c₃ (delegation to DA′) accumulate until the joint reach crosses P(t) at c₃, yielding a persistent, delegated, cross-purpose copy of D₂—shadow infrastructure outside any inventory. The trajectory is conceptual and the vertical axis qualitative; the figure shows relative ordering, not a measured capability score.