Writing · AI Governance · September 2026
Every framework for governing AI agents assumes the agent can be inspected at a point in time. Sustained use produces something that cannot.
Board governance of AI agents has organised itself, quite reasonably, around a question that can be answered. What is this system permitted to do? Name the agent, register it, define its scope, log its actions, review the log. That is the shape of every credible framework now in circulation, including this firm’s own. The Emerging Risk of AI Agent Networks, published in February 2026, sets out nine categories of risk, a three-layer model of preventive, detective and responsive controls, an agent registry, an Agent Bill of Materials and a five-category drift scorecard. This paper takes that framework as its starting point, and argues that there is one thing it cannot reach.
The framework works. It works because it treats the agent as an object with properties: an owner, a purpose, a set of tools, a data scope, an autonomy level. Properties can be recorded. Recorded properties can be audited. Audited properties can be governed.
Sustained use of long-context AI produces something that does not have properties in that sense. It has a history. And a history is not a property.
That distinction sounds academic. It is not. It determines whether the control you have built actually reaches the thing creating the exposure.
Set aside the architecture for a moment and describe the phenomenon.
An agent used continuously over months does not behave like the same agent used once. Standing instructions accumulate. Corrections accumulate. It learns which of a firm's conventions matter and which are decoration. It learns that a particular kind of answer gets rejected, and stops offering it. It carries forward assumptions that were never written down, because they were established by being enforced.
None of this is a designed feature. It is an emergent property of consistent use, and it emerges in proportion to how rigorously the user corrects. Most users do not correct. Most users therefore never produce it, which is one reason the phenomenon is not yet widely reported.
Where it does emerge, the working relationship becomes materially more capable than the same model used episodically. That is why people persist with it. It is also why it constitutes a governance object that nobody has classified.
An earlier paper, Who Owns Your Intelligence?, asked who owns what an organisation accumulates this way. This paper asks a prior question: whether it can be governed at all.
This is observable now, in live professional use, at the level of individual practitioners rather than enterprise deployments. It is not a forecast.
The governance instruments now being built and sold all share one assumption. They assume the governable unit is inspectable at a point in time.
The agent registry records what an agent is. The Agent Bill of Materials records what it is assembled from. The tool gateway checks each call against a policy. The drift scorecard watches for expansions in permission, action, delegation, data and policy. Every one of those is a snapshot instrument, and every one of them is correct.
The emerging Agent Discovery and Governance platforms operate on the same premise. They are very good at the problem they address: finding agents nobody registered, mapping what they can reach, flagging non-human identities with more privilege than anyone intended. That is real work and it needs doing.
But discovery answers the question what exists. Inventory answers what is it. Neither answers what has this become.
Take the drift scorecard from that assessment as the clearest case. It monitors five categories, and each is a change in a recorded attribute — a new access scope, a new action type, a spawned sub-agent, a broader retrieval source, a relaxed guardrail. All five are detectable because all five are changes to something that was written down.
Conversational drift is not a change to a recorded attribute. Nothing was granted. No scope expanded. No new tool appeared. The agent's registered properties on day two hundred are identical to day one. What has changed is everything that was established between those two points, none of which was ever a field in a register.
The instrument is not failing. It is measuring a different thing.
Vendors sell memory. Memory is a stored artefact: a set of facts and preferences retained across sessions, inspectable, editable, deletable. Memory is governable by existing means, and organisations should govern it.
Trajectory is the path. It is the accumulated effect of every exchange, every correction, every rejection, every assumption that was allowed to stand. Trajectory is not stored anywhere as an object. It is the residue of a process, distributed across a corpus of exchange, and it cannot be edited because there is nothing discrete to edit.
Here is the part with no precedent in enterprise technology, and it is the central claim of this paper.
Trajectory is bi-directional.
The agent accumulates conditioning through sustained exchange. So does the human. The practitioner learns what to ask and how, which framings produce useful work and which produce fluent noise, where the system is reliable and where it must be checked. That calibration is real, it is valuable, and it took months to acquire.
Which means the governable unit is not a system. It is a working relationship between a person and a system, and neither party can fully reconstruct how it arrived where it is.
Every governance framework in existence assumes a one-way relationship. The organisation governs the agent. Nothing in the vocabulary of enterprise risk describes a co-constructed dependency in which the human half is as conditioned as the machine half, and in which the value resides in the conditioning rather than in either party.
The instinctive answer is logging. Log everything, and the trajectory becomes reconstructible.
Full logs are necessary. They are not sufficient, and the reason matters.
A complete log tells you what was said. It does not tell you which exchange changed the system's behaviour. Reading a hundred thousand words of accumulated exchange does not surface the moment a standing assumption was established, because the establishing moment usually looks unremarkable. It was a correction, accepted, and never mentioned again. Its significance is only visible in what stopped happening afterwards.
Replay is not reconstruction. You can retrieve the record. You cannot retrieve the causation.
That has a direct consequence for anyone who may one day have to explain a decision. The February assessment set a clear standard here: audit trails must be detailed enough to reconstruct the complete decision chain from initial trigger to final action, across agent boundaries where necessary. For a discrete agent action, that is achievable. For an output shaped by two hundred days of accumulated calibration, the chain does not terminate. Every answer is a function of the whole path.
An organisation in that position holds a complete record and cannot produce an explanation from it. That is a worse position than an incomplete record, because it looks like compliance.
Long-context agents are not fungible, and this is where the exposure becomes commercial rather than theoretical.
An agent that has accumulated eighteen months of calibration inside a specific practice cannot be replaced by the same model freshly provisioned. The model is identical. The working relationship is not, and the working relationship is what was producing the output.
Boards understand this risk in its human form. It is called key person dependency, and there are established instruments for it: documentation, deputies, handover protocols, succession plans, notice periods. Nobody thinks it is acceptable for a firm's capability to walk out of the door in one head.
The same dependency is now forming around long-context agents, and none of those instruments has been applied to it. There is no handover protocol for a trajectory. There is no deputy. The documentation problem is the audit problem above: the thing that would need documenting is not written down anywhere, including inside the system.
This is not a vendor lock-in issue, and framing it that way understates it. Vendor lock-in is about the cost of switching supplier. This is about whether a capability the business now depends on survives the switch at all — or the account change, the licence migration, the provider's decision to retire a model version.
A model deprecation notice is, in this framing, an operational continuity event. Almost no organisation currently treats it as one.
Put the three problems together and the shape of the gap is clear.
The unit that creates the exposure is the trajectory. The instruments that exist govern properties. Nothing in current practice, current tooling or current regulation takes the trajectory as its object, for the straightforward reason that the trajectory has only recently become large enough to matter.
There is no vocabulary for it. There is no field in any register that holds it. There is no standard that requires its disclosure, and no methodology for assessing it. The EU AI Act is built around risk classification of systems and their intended purpose; its high-risk obligations, originally due in August 2026, have been deferred to December 2027. A system whose behaviour is a function of its history sits awkwardly inside a framework that classifies by design.
This is not an argument against the existing frameworks. They address the present-day problem, and the present-day problem is real: agents nobody registered, permissions nobody reviewed, actions nobody logged. That work comes first.
It is an argument that the next gap is already opening, and that it will not be closed by doing more of what is currently being built. Discovery tools will get better at discovery. Drift scorecards will get better at detecting granted permissions. Neither converges on the trajectory, because neither is pointed at it.
Three implications follow, and each is actionable before the vocabulary exists.
Continue using it. It catches permissions drift, action drift and delegation drift, and those are live risks today. But do not accept a clean scorecard as evidence that an agent has not changed. A clean scorecard on a long-context agent means its recorded attributes are unchanged. It says nothing about what the agent has become through use, and the two are no longer the same question.
Ask the question the board already asks about people. If this capability became unavailable next month, what would the organisation lose, and how long would it take to rebuild? For an agent with substantial accumulated context, the honest answer is usually months, and usually nobody has asked. The instruments exist. They have simply never been applied to a non-human dependency.
The direction of travel across jurisdictions is towards demonstrating how AI-influenced decisions were reached and who was accountable. Organisations preparing for that are preparing to produce logs. Logs of a path-dependent system will not answer the question asked. The organisations that will be able to answer it are the ones that start recording the trajectory deliberately now — what standing assumptions were established, when, by whom, and on what basis — rather than assuming the transcript constitutes the record.
None of this is a reason to slow adoption. The capability that accumulates through sustained use is genuine and it is substantial, and the firms that develop it will outperform the firms that use the same models episodically.
It is a reason to recognise, early, that the thing being adopted is not the thing being governed.
The agent your framework describes is a set of properties. The agent producing your output has a history. Until the second becomes the unit of governance, the control you have built reaches the part of the system that was never the risk.
Would you like to discuss this paper further?
Contact Bill Lewis — bill@linacre.net.
Bill Lewis is Founding Partner of Linacre Capital Partners. He provides independent counsel to Chairs, CEOs and Founders on their highest-stakes decisions, on the AI now operating inside their businesses, and on major programmes that are starting to tilt.
Visit Linacre Capital.
Companion paper
The Emerging Risk of AI Agent Networks, February 2026 — a board-level risk assessment setting out nine categories of risk, a three-layer governance framework and regulatory alignment across the US, UK and EU. That assessment addresses the governance of agents as they exist today. This paper addresses what sustained use turns them into.