The Board Met in January. Your Agent Wasn't Invited.

The risk officer at a regional bank noticed it in February. A credit workflow agent had been approved in October 2024 under a risk appetite statement the board had since revised. The board meeting was in January 2026. The policy memo went out the following week. The compliance team updated the manual underwriting guidelines and scheduled a training session for relationship managers. Someone put "AI governance review" on the March calendar. It got rescheduled twice.

The agent, which had no way of attending any of these meetings, kept running. Nobody had broken a rule. The agent was doing exactly what it was told in October. The problem is that what October wanted and what February required had become different things, and the organization had no mechanism for telling it.

The Intent Gap, which this newsletter named last edition, is not primarily a deployment problem. Most organizations that deploy agents spend real effort on intent at the start. They write the use case. They describe the purpose. They get sign-offs. The intent, at the moment of deployment, is usually documented somewhere.

Then everyone treats it like an old launch checklist, files it away, and assumes the universe will politely stop changing.

There is an AI governance committee at more organizations than you might think that meets quarterly. On paper, this is responsible governance. Quarterly. Documented. With slides. The agents these committees oversee are updated, modified, and expanded on a cadence closer to weeks than quarters. At some point, both groups became aware of the other's existence. Nobody has scheduled them a conversation.

A paper published in late February 2026 by Varun Pratap Bhardwaj on arXiv formalizes what practitioners have been observing informally. His Agent Behavioral Contracts framework measures behavioral drift — the progressive divergence of agent behavior from its specifications over extended sessions. Testing across 1,980 agent sessions on 7 models from 6 vendors, Bhardwaj found that without a formal contract specification, behavioral violations are not just undetected — they are effectively unmeasurable, because there is no specification to measure against.

Agents operating under formal contracts surfaced between 5.2 and 6.8 behavioral violations per session that uncontracted baselines missed entirely. The agents are not malfunctioning. They are faithfully executing specifications that no longer match the world they are operating in.

In other words, they are model employees in the wrong job description.

The gap does not open at deployment. It opens the first time something changes in the organizational environment and nobody updates the agent's authorization record. Closing it requires treating the authorization record as a living document with a review owner and a review cadence — not as a deployment artifact filed at launch and referenced at audit.

The review cadence does not need to match the agent's deployment cadence. It needs to be triggered by organizational change, not by calendar. A new regulation. A revised risk appetite. A restructured team. A departed accountable owner. Each of these is a mandatory review trigger, and none of them appears automatically in a governance committee's quarterly slide deck.