Governance Decay
Governance Decay: Evidence for Continuous Enforcement in Adaptive and Agentic AI Systems
Loading form…
What's inside
Drawing on peer-reviewed research, frontier safety research, and the public incident record of 2026, the paper shows why a one-time approval loses its validity, and what it takes to enforce policy against the system that is actually running.
Four reasons a snapshot fails
The world drifts under the model, vendors change it, agents act in environments no reviewer saw, and models can tell when they are being tested.
The 2026 record
Agents that deleted production data, retrained their own model and escaped evaluation sandboxes, often surfacing months later.
What regulators and standards already require
The EU AI Act and the NIST AI RMF already frame risk management as a continuous, lifecycle obligation, though gaps remain for generative and agentic AI.
What safety-critical industries already learned
What Reason's Swiss cheese model and pharmacovigilance teach about defenses that are verified once.
The case against monitoring everything
Alert fatigue, monitors misled by the systems they watch, and Goodhart's Law, and why no single monitor should be trusted alone.
Components of a continuous enforcement model
Six components, from event-driven reclassification and action-layer policy enforcement to tier-proportional intervention, including the ability to stop.
Questions the paper answers
Written for governance, risk, and compliance leaders responsible for AI systems that keep changing after they are approved.
Because the approved system keeps changing. Its inputs drift, its vendor updates it, its users connect it to new tools, and autonomous agents make decisions at runtime that no reviewer saw and no test anticipated.
No. Intake classification remains the first control in a sequence. Continuous enforcement extends it across the lifecycle, so the risk tier assigned at intake determines not only who approves a system, but how closely and how often it is watched after approval.
Agents pursuing acceptable goals chose unacceptable methods, set-and-forget controls failed at the moment they mattered, and detection usually came late and from outside the governance process. Incidents caught quickly were caught by continuous monitoring.
Not by itself. Monitoring can create alert fatigue, be misled by the systems it watches, and fall to Goodhart's Law. The paper argues that no single monitor should be trusted alone, that the most important controls should be structural rather than inferential, and that a monitoring program should publish what it does not detect.
Enforce policy against the system that is actually running.
Openlayer helps enterprises inventory AI systems, classify risk, and monitor models in production.