Intent Drift

Expanded Definition

Intent drift describes a security failure mode in which an AI agent, workflow, or chained automation begins with one approved purpose but ends in an outcome that no longer matches that purpose. The steps can each look valid in isolation while the overall sequence becomes unsafe, overbroad, or non-compliant.

In NHI security, this concept matters because agent sessions often inherit credentials, tool permissions, and contextual memory that outlive the original request. That makes intent drift different from a simple authorization failure. A single action may be permitted under policy, yet the accumulated effect of multiple actions can still violate least privilege, data handling rules, or change-control boundaries. The control problem is therefore not only "was each step allowed?" but also "did the chain still serve the approved intent?" This is why frameworks such as the NIST Cybersecurity Framework 2.0 remain relevant even when the core risk is agentic rather than human.

Definitions vary across vendors on whether intent drift is treated as an agent governance issue, a prompt-security issue, or a broader NHI lifecycle issue, but the operational problem is the same: delegated authority can outgrow the request that created it. The most common misapplication is assuming step-level approval is sufficient, which occurs when teams ignore session continuity and cumulative side effects.

Examples and Use Cases

Implementing controls against intent drift rigorously often introduces context-checking overhead, requiring organisations to weigh agent flexibility against tighter session review and logging.

• An AI agent is asked to summarize customer complaints, then later uses the same session and API token to export full ticket histories for "analysis," creating data exposure beyond the original purpose.
• A workflow agent receives approval to open a support case, but successive tool calls allow it to fetch admin metadata, change routing rules, and trigger notifications that were never part of the request.
• A procurement assistant is authorized to compare vendor quotes, then drifts into approving renewal terms and generating a purchase order without a fresh human review.
• A compromised or overextended session resembles patterns seen in the Salesloft OAuth token breach, where token reuse and downstream actions turned limited access into broader impact.
• In architectures aligned to NIST Cybersecurity Framework 2.0, teams map session boundaries, logging, and review points so the declared task remains traceable across tool calls.

NHIMG research shows that 97% of NHIs carry excessive privileges, which makes intent drift far more dangerous because the same session can reach far beyond what the operator intended. The most practical use case for the term is incident review: it helps analysts explain how a harmless-looking sequence became a policy breach even though no single action triggered an alert.

Why It Matters in NHI Security

Intent drift is a governance issue because NHI failures rarely begin with one dramatic exploit. They often emerge from normal automation combined with stale authorization, weak guardrails, and incomplete visibility. When an agent can chain allowed actions into an unapproved outcome, the organization may pass individual control checks while still violating data residency, segregation of duties, or privileged access rules.

This is also why intent drift belongs in post-incident analysis. It forces security teams to examine session purpose, tool reach, credential scope, and human override points rather than only looking for malicious prompts or obviously suspicious commands. NHI Mgmt Group reports that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which underscores how often machine identity misuse becomes a business problem once access is chained across systems. The operational lesson is that intent drift is not just theoretical drift in model behavior; it is a practical sign that identity, authorization, and workflow design are misaligned.

Organisations typically encounter the consequence only after a routine automation produces an unauthorized data movement, at which point intent drift becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Intent-Dimension Drift
• Runtime Intent Drift
• What is the difference between logging actions and logging intent for AI agents?
• How should security teams think about a compromised integration like Drift?