Capability drift is the gradual mismatch between what an AI agent or automated system can do and what it is allowed or expected to do. In identity security, it occurs when permissions, tools, policies, or workflows change over time, creating hidden access expansion, control gaps, and governance risk.
How capability drift happens
Capability drift emerges when an AI agent’s permissions, tools, policies, or workflow assumptions change over time without the agent’s operating envelope being revalidated. The result is a widening gap between intended authority and actual capability.
This is not just a configuration nuisance. In automated systems, small changes such as a new connector, a broader token scope, or an updated policy can quietly alter what the system can reach, modify, or disclose.
Why capability drift is dangerous
The danger is hidden expansion of access. An agent may continue to behave as if it is constrained, while the surrounding environment has already granted it broader reach, which can create unintended data exposure, over-action, or policy bypass.
When drift accumulates across tools and workflows, governance becomes brittle. A system can appear compliant in design but gradually depart from the approved operating model, especially where permissions are inherited from integrations or delegated access paths.
Where capability drift shows up in practice
Capability drift often appears in agentic workflows, orchestration layers, and SaaS integrations where roles, tokens, or tool permissions are reused across changing business processes. It is especially visible when a system’s access is expanded for a temporary task and never reduced again.
Drift can also emerge from organisational change. New automation steps, refreshed policies, changed data sources, or replaced services may make earlier guardrails incomplete even though no single change looked risky in isolation.
That is why identity and access controls matter here: the underlying issue is not only what the system is allowed to do, but whether that allowance still matches current intent. For a broader control lens, NIST SP 800-53 Rev 5 Security and Privacy Controls helps anchor governance around access control, configuration management, and auditability, while NIST SP 800-207 Zero Trust Architecture reinforces continuous verification and least privilege.
How to recognise and reduce capability drift
Capability drift is usually discovered through mismatch, not alarms: a review of approved workflows no longer matches the effective permissions, tool inventory, or runtime behaviour. The most reliable checks compare intended capability to actual connected tools, token scopes, and approval boundaries.
Reducing drift means treating permissions and tool access as living controls, not one-time setup decisions. Periodic access review, explicit ownership for agent toolsets, and change control for new integrations all help keep the system inside its intended envelope.
For agentic environments, the risk is especially relevant because the same update that improves usefulness can also expand authority. OWASP Non-Human Identity Top 10 is a useful reference for the surrounding control problems, including overprivilege, secret handling, and identity reuse in automated systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Capability drift is fundamentally a mismatch in granted versus intended access. |
| CM-2 — Baseline Configuration | Drift often begins when toolsets, policies, or workflows change without baseline review. | |
| AU-2 — Event Logging | Auditing is needed to spot capability expansion and unexpected tool use over time. | |
| Recommendation — Revalidate effective permissions and remove any excess access that no longer matches the approved workflow. Maintain and review configuration baselines so agent capability stays aligned to the approved operating model. Log and review administrative and agent actions to detect unauthorized capability growth and workflow deviation. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Zero Trust directly supports continuous verification when capabilities and trust boundaries change. |
| Recommendation — Continuously verify access and trust decisions instead of assuming prior authorisation remains valid. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Capability drift commonly results in non-human identities receiving more access than intended. |
| Recommendation — Audit non-human identities for excess privilege and prune access that exceeds current task requirements. | ||