Agentic Shadow Infrastructure: How AI Supply-Chain Drift Creates Unmanaged Enterprise Infrastructure

Abstract

Agent identity governance governs an agent’s identity, credentials, and lifecycle, but assumes the composition it was approved with is the composition it runs with. That stability assumption is unenforced: no lifecycle mechanism evaluates an agent’s evolving composition against its approved baseline. An agent’s effective composition—tools, data sources, delegated authorities, child agents—is a runtime supply chain of capability, and it drifts. We introduce composition drift, the departure of effective composition from the terms of approval, and isolate its sharpest form, compositional drift: individually approved changes accumulating into a capability none authorized alone. We formalize this with a two-stage operator: a component diff detects that the composition changed; a capability-closure stage detects when it authorized something new. The contribution is a temporal governance model linking emergent capability to reauthorization and inventory reconciliation. Drift produces shadow infrastructure: resources provisioned outside any inventory through benign, individually approved pathways. We propose composition attestation, a runtime control complementary to identity governance, and evaluate it in a pre-registered study. Across five thousand trajectories the detector separates compositional drift from authorized growth where a static analyzer cannot; an ablation isolates the primitives that cause it; and, in controlled live agent runs across three models (9B to 70B parameters, Llama and Qwen lineages), agents given only benign tasks provision unauthorized shadow infrastructure in 59% to 99% of drift-conducive trials against 0% to 19% of matched controls.