A one-time review breaks as soon as the agent gains a new tool, a new dataset, or a new workflow. Governance that is frozen at approval time cannot keep up with runtime drift, which means the real access path and the approved access path quickly diverge.