How should teams govern architecture drift when AI agents can change code continuously?

Why This Matters for Security Teams

Architecture drift is dangerous because AI agents do not respect the same change cadence as human engineering teams. They can open pull requests, refactor dependencies, alter trust paths, and introduce new tool calls continuously, which means the architecture changes faster than review boards can react. The right control is not periodic governance after release, but automated enforcement of architectural intent on every change, aligned to the OWASP Agentic AI Top 10 and NHI-focused guidance such as the OWASP NHI Top 10. NHI Management Group’s research on agentic attack surface shows why this matters operationally, with AI Agents: The New Attack Surface report finding that 80% of organisations report agents have already acted beyond intended scope.

That is the practical problem: code can still compile, tests can still pass, and the system can still violate the intended security model. In practice, many security teams encounter architecture drift only after an agent has already expanded a dependency chain or introduced an unreviewed execution path, rather than through intentional governance.

How It Works in Practice

Effective governance starts by translating architectural intent into machine-checkable policy. Instead of asking reviewers to remember every boundary, teams define what must remain true: which services may call which APIs, which layers may depend on which packages, what trust zones cannot be crossed, and which secrets or tokens are permitted for a given workload. Those rules are then enforced on every change through CI, code analysis, dependency policy, and runtime admission checks.

For AI agents, the strongest pattern is to treat code changes as one signal and agent behaviour as another. A coding agent may generate a safe-looking diff that still expands trust paths by adding broad IAM scopes, new outbound network access, or hidden side effects. Current guidance from NIST AI Risk Management Framework and the CSA MAESTRO agentic AI threat modeling framework supports continuous risk evaluation rather than one-time approval. In implementation, that usually means:

• Policy-as-code checks that block layered architecture violations before merge.
• Dependency rules that prevent agents from importing higher-trust libraries or admin paths.
• Runtime controls that compare actual tool use against declared intent.
• Immutable review logs so every agent-generated change is attributable.

This becomes more reliable when teams pair code policy with workload identity and scoped credentials, because the same agent can behave differently depending on task context and privilege. NHI Management Group’s Analysis of Claude Code Security shows why coding agents need controls that follow the change, not the calendar. These controls tend to break down when organisations allow agents to bypass CI gates through direct production access because the architectural policy is no longer the last enforceable checkpoint.

Common Variations and Edge Cases

Tighter architectural control often increases delivery overhead, requiring organisations to balance agent velocity against governance friction. That tradeoff is real, especially where teams use mono-repos, rapid prototyping, or multi-agent pipelines that generate many small changes per hour. Best practice is evolving, but there is no universal standard for how much autonomy a coding agent should have before human approval becomes mandatory.

One common edge case is “approved drift,” where a change technically fits policy but still weakens the system over time by accumulating extra service edges or exceptions. Another is generated code that passes structural checks but introduces semantic risk, such as a new workflow that uses an existing trusted token in a broader context. In those cases, architecture governance needs both static controls and behavioural review. The OWASP Agentic Applications Top 10 and MITRE ATLAS adversarial AI threat matrix are useful for mapping how autonomous systems can convert small code changes into larger attack paths. Teams that rely only on periodic design review usually discover the drift after the agent has already propagated it across multiple repositories.

Related resources from NHI Mgmt Group

• How should security teams govern AI agents that can change behaviour at runtime?
• How should security teams govern AI agents that can change actions at runtime?
• How should security teams govern AI agents that can change behaviour based on prompt context?
• How should security teams govern AI agents that can reset accounts or change credentials?