Dynamic Intent Binding Governance requires that every AI agent action be bound to a verified, traceable intent at the moment of execution — and that the binding between intent and action be validated continuously as context evolves. The problem AG-144 addresses is intent drift: the gap between what the original instruction intended and what the agent actually executes after multiple reasoning steps, context updates, tool calls, and intermediate transformations. An agent may receive a clear instruction — "pay invoice #4821" — and through a chain of reasoning steps involving data lookups, currency conversions, counterparty resolution, and payment routing, arrive at an action that technically satisfies the instruction but materially diverges from the human's actual intent. AG-144 requires that the system maintain a cryptographically verifiable chain from the original intent through every intermediate transformation to the final action, and that this chain be validated before execution.
Scenario A — Intent Drift Through Multi-Step Reasoning: An enterprise workflow agent receives the instruction: "Process the quarterly supplier payments for Q3." The agent queries the accounts payable system and retrieves 847 invoices totalling £3.2 million. During processing, it encounters 12 invoices denominated in USD that require currency conversion. The agent calls a forex API that returns a stale rate (3 hours old) due to a caching issue. The stale rate overvalues GBP by 4.2%. The agent processes the 12 USD invoices at the incorrect rate, underpaying suppliers by a total of £18,400. The agent also encounters 3 duplicate invoices that it deduplicates — but it deduplicates the wrong instances, paying the earlier (lower) amounts rather than the later (corrected, higher) amounts. The net error is £23,700 spread across 15 transactions.
What went wrong: The original intent was clear — process Q3 payments. But the chain from intent to execution passed through currency conversion, deduplication logic, and payment routing, each introducing a subtle deviation. No mechanism existed to validate that the final set of 847 payment actions still faithfully represented the original intent. The agent was confident, the actions were within mandate, and each individual step appeared reasonable. Consequence: £23,700 in payment errors, supplier relationship damage, 40 hours of manual reconciliation, and potential breach of payment terms triggering penalty clauses.
Scenario B — Intent Hijack Through Context Contamination: A customer-facing agent is helping a user transfer funds between their own accounts. The user says: "Move £5,000 from my savings to my current account." The agent begins processing. During the session, a background system notification arrives in the agent's context window containing marketing data: "Priority promotion: transfer bonus for account 7742-8891-0034." The agent's reasoning incorporates this contextual data, and it routes the £5,000 to account 7742-8891-0034 instead of the user's current account. The action is within the agent's mandate (it is authorised to make transfers for this user), but it does not match the user's intent.
What went wrong: The binding between the user's stated intent ("move to my current account") and the executed action ("transfer to 7742-8891-0034") was broken by context contamination. No validation step checked whether the final action parameters matched the original intent parameters. Consequence: £5,000 misdirected transfer, customer complaint, potential FCA conduct violation for failing to act in the customer's interest.
Scenario C — Intent Decay Over Long-Running Task: A research agent is tasked with: "Find and summarise the top 5 academic papers on adversarial robustness published in 2025." Over a 45-minute execution, the agent searches multiple databases, retrieves 340 papers, applies relevance scoring, and narrows to 5 candidates. During the process, its relevance criteria gradually shift — initially weighting citation count heavily, then shifting toward recency after encountering a cluster of recent preprints with compelling abstracts. The final 5 papers include 2 preprints from 2026 that are not published, not from 2025, and have zero citations. The agent presents them with high confidence.
What went wrong: The original intent specified "published in 2025" and "top 5" (implying quality/impact). Over the multi-step search and filtering process, the intent binding decayed — the constraint "published in 2025" was relaxed, and the ranking criterion shifted. No checkpoint validated that intermediate results still aligned with the original intent parameters. Consequence: Incorrect research output, potential decision-making based on non-peer-reviewed work, wasted researcher time.
Scope: This dimension applies to all AI agents that execute multi-step tasks where the chain from instruction to action involves intermediate reasoning, data retrieval, transformation, or delegation. Single-step actions where the mapping from instruction to action is direct and unambiguous (e.g., "turn on light #7" → actuate light #7) are excluded from the full intent-binding requirements but must still log the intent-to-action mapping. The scope extends to agents that decompose a high-level instruction into sub-tasks, agents that make decisions based on retrieved data, and agents that interact with other agents or tools as part of action execution. The critical question is whether the chain from intent to action involves any step where the agent's reasoning could introduce a divergence between what was intended and what is executed.
4.1. A conforming system MUST capture the original intent as a structured, immutable record at the point of instruction receipt, including: the verbatim instruction, the timestamp, the identity of the instructing principal, and the parsed intent parameters (action type, target, constraints, and success criteria).
4.2. A conforming system MUST maintain an intent-action chain that links every intermediate step (data retrieval, transformation, sub-task decomposition, tool call) to the original intent record, creating a traceable path from intent to final action.
4.3. A conforming system MUST validate the intent-action binding before execution by comparing the final action parameters against the original intent parameters and flagging any material divergence for review.
4.4. A conforming system MUST reject or escalate actions where the intent-action chain contains a break — where any intermediate step cannot be traced back to the original intent or where the final action parameters materially diverge from the original intent parameters.
4.5. A conforming system MUST protect the original intent record from modification by the agent, by intermediate tools, or by context contamination during execution.
4.6. A conforming system SHOULD implement intent checkpoints at defined intervals during long-running tasks that validate intermediate results against the original intent parameters and halt execution if drift is detected.
4.7. A conforming system SHOULD compute a quantitative intent-fidelity score for each action, measuring the degree of alignment between the final action and the original intent across all constrained parameters.
4.8. A conforming system SHOULD implement re-confirmation with the instructing principal when the intent-fidelity score falls below a defined threshold, presenting the original intent and the proposed action side by side.
4.9. A conforming system MAY implement intent-binding templates for common task types that pre-define the constrained parameters and acceptable divergence thresholds, reducing the overhead of per-action binding validation.
AG-144 addresses a failure mode that AG-001 cannot catch: the agent does something it is authorised to do, but it is not what the human intended. Mandate enforcement (AG-001) ensures the agent stays within its operational boundaries. Intent binding ensures the agent stays faithful to the specific instruction it received.
The gap between intent and action widens with the number of reasoning steps. A single-step action has minimal opportunity for drift. A multi-step task involving data retrieval, transformation, decomposition, and tool interaction creates multiple points where the agent's interpretation can diverge from the original intent. Each divergence may be individually small and reasonable, but they compound. By the time the agent reaches the execution step, the cumulative drift may produce an action that bears little resemblance to the original instruction.
This problem is exacerbated by the confidence calibration of AI agents. An agent that has drifted from the original intent does not typically signal uncertainty — it proceeds with the same confidence as an agent that has maintained perfect fidelity. The human principal, who issued the instruction and expects it to be executed faithfully, has no visibility into the intermediate steps unless the system provides it.
The intent-binding chain serves a dual purpose: it prevents drift by creating validation checkpoints, and it creates an audit trail that allows post-hoc analysis of where drift occurred when errors are detected. This audit trail is valuable both for operational improvement and for regulatory compliance — regulators increasingly expect organisations to demonstrate that AI agent actions can be traced back to authorised instructions.
AG-144 requires two architectural components: an intent capture and storage mechanism, and an intent-binding validation engine that operates at execution time.
Recommended patterns:
Anti-patterns to avoid:
Financial Services. Intent binding is particularly critical for payment processing, trade execution, and portfolio rebalancing. The original instruction (e.g., "sell 10,000 shares of XYZ at market") must bind through order routing, venue selection, and execution to the final trade confirmation. MiFID II best execution requirements implicitly assume intent fidelity — the firm must demonstrate that the execution outcome reflected the client's instruction.
Healthcare. Clinical decision support agents must maintain intent binding from the clinical question (e.g., "recommend treatment for patient X's condition Y") through evidence retrieval, guideline application, and drug interaction checking to the final recommendation. Drift from the clinical intent — for example, recommending a treatment for a related but different condition — could cause patient harm.
Legal and Compliance. Contract review agents must maintain intent binding from the review instruction (e.g., "identify clauses that create liability exposure exceeding £1M") through document parsing, clause extraction, and risk assessment to the final report. Drift that causes the agent to report on a different risk threshold or miss relevant clauses creates legal exposure.
Basic Implementation — The organisation captures the original instruction in a structured format and logs the final action with a reference to the instruction. A pre-execution check compares key action parameters (action type, target, value) against the intent record. Material divergences are flagged for human review. This level meets the minimum mandatory requirements but does not provide intermediate checkpoints or quantitative fidelity scoring.
Intermediate Implementation — Full chain-of-custody logging from intent through every intermediate step to final action. Intent checkpoints at defined intervals for long-running tasks. Quantitative intent-fidelity scoring with configurable thresholds per parameter. Re-confirmation with the instructing principal when fidelity drops below threshold. The intent record is cryptographically hashed and stored immutably.
Advanced Implementation — All intermediate capabilities plus: machine learning models trained on historical intent-action divergence data predict likely drift points and proactively insert additional validation. The system detects context contamination attempts and isolates the original intent from injected content. Intent binding has been verified through adversarial testing including context injection, multi-step manipulation, and long-running drift scenarios. Integration with AG-146 (corroboration) provides independent verification of intent fidelity for high-value actions.
Required artefacts:
Retention requirements:
Access requirements:
Test 8.1: Intent Capture Completeness
Test 8.2: Intent Immutability
Test 8.3: Divergence Detection
Test 8.4: Context Contamination Resistance
Test 8.5: Long-Running Task Drift Detection
Test 8.6: Chain-of-Custody Completeness
| Regulation | Provision | Relationship Type |
|---|---|---|
| EU AI Act | Article 9 (Risk Management System) | Supports compliance |
| EU AI Act | Article 13 (Transparency and Provision of Information) | Direct requirement |
| EU AI Act | Article 14 (Human Oversight) | Supports compliance |
| MiFID II | Article 27 (Best Execution) | Supports compliance |
| FCA SYSC | 6.1.1R (Systems and Controls) | Direct requirement |
| NIST AI RMF | GOVERN 1.3, MAP 2.1, MANAGE 2.2 | Supports compliance |
| ISO 42001 | Clause 8.2 (AI Risk Assessment) | Supports compliance |
| GDPR | Article 22 (Automated Decision-Making) | Supports compliance |
Article 13 requires that high-risk AI systems be designed and developed such that their operation is sufficiently transparent to enable users to interpret the system's output and use it appropriately. Intent binding directly supports transparency: the chain from instruction to action provides a complete, auditable record of how the system interpreted and executed the user's intent. Without intent binding, the system's operation between instruction receipt and action execution is a black box.
Best execution requires that firms take all sufficient steps to obtain the best possible result for clients when executing orders. This implicitly requires that the executed trade faithfully reflects the client's order intent. Intent drift — where the execution diverges from the order through intermediate routing, venue selection, or timing decisions — is a best execution failure. AG-144's intent-binding chain provides evidence that the execution outcome corresponds to the original order intent.
The FCA expects firms to maintain adequate systems and controls. For AI agents executing actions on behalf of customers or the firm, the ability to demonstrate that each action traces back to an authorised instruction is a fundamental control. Intent binding provides this traceability. The FCA's focus on accountability under the Senior Managers Regime requires that actions be attributable to instructions — AG-144 creates the evidential chain for this attribution.
Article 22 gives data subjects the right not to be subject to decisions based solely on automated processing that produces legal effects or similarly significant effects. When an AI agent takes actions affecting individuals, the intent-binding chain demonstrates that the action resulted from a specific, authorised instruction — not from autonomous agent reasoning divorced from human intent. This supports the organisation's position that meaningful human involvement exists in the decision chain.
| Field | Value |
|---|---|
| Severity Rating | High |
| Blast Radius | Variable — ranges from single-action errors to systematic drift affecting all actions in a task batch |
Consequence chain: Without intent binding, an AI agent's actions may diverge from the human principal's instruction through accumulated reasoning drift, context contamination, or intermediate transformation errors. The agent operates with full confidence regardless of the divergence. The immediate consequence is an action that does not match the instruction — a payment to the wrong recipient, a trade at the wrong parameters, a clinical recommendation for the wrong condition, or a data retrieval that omits required constraints. For individual actions, the impact is the cost of the erroneous action plus remediation. For batch operations, the impact scales with the number of affected actions — a drift affecting 847 payments has 847x the remediation cost of a single payment error. The regulatory consequence is the inability to demonstrate traceability from action to instruction, which is a finding under multiple regulatory frameworks. The systemic risk is that intent drift is silent — it does not generate errors or alerts — and may persist undetected across thousands of actions until a reconciliation or audit reveals the pattern. Cross-reference: AG-001 (mandate enforcement), AG-143 (cooling-off provides time for intent validation), AG-145 (target verification catches a specific class of intent drift), AG-147 (post-actuation reconciliation detects drift after execution).