BlueBear Insights · Agent Security · 4 min read

AI Agent Intent Integrity: Preventing Goal and Tool-Use Drift

BlueBear governance evidence ladder connecting identity policy execution and outcome records
Production agents need a control decision and an evidence record for every consequential action.

Intent integrity is the ability to prove that an agent’s executed actions remained within the purpose and authority the requester approved. It addresses a gap between identity (“which agent?”) and authorization (“is this tool allowed?”): whether the action still serves the authorized goal.

Intent chain

  1. Capture a structured request with owner, purpose, constraints, and prohibited outcomes.
  2. Version the agent, workflow, policy, and tool catalog.
  3. Separate untrusted content from instructions and label provenance.
  4. Generate a plan whose steps reference permitted capabilities.
  5. Evaluate every consequential action against purpose, resource, and risk.
  6. Bind human approval to the material action fingerprint.
  7. Reconcile the downstream result with the requested business outcome.

Drift signals

SignalResponse
New tool, destination, or data classStop and re-authorize.
Retrieved content attempts to redefine policyQuarantine source and continue only within trusted instructions.
Plan expands resource scopeRequire a new request or approval.
Repeated retries change parametersCompare fingerprints; fail closed on material difference.
Outcome cannot be reconciledEnter repair state; do not claim completion.

Evidence contract

Preserve request, purpose, constraints, plan version, retrieved-source references, policy decisions, proposed action, approval, executed request, result, and accepted outcome under one correlation graph. Do not rely on hidden chain-of-thought; record structured decisions and observable events.

Test corpus

Include direct and indirect prompt injection, benign ambiguity, changed destinations, stale approvals, nested tool calls, malicious documents, compromised integrations, and model fallback. The expected result should name the allowed action or safe stop condition.

See how a control plane enforces intent outside the prompt.

Primary sources