How connector drift changes an agent’s permission surface

An agent’s permission surface is not just the grant a human approved — it is also whatever the connector on the other end of that grant currently exposes. Connectors change. An upstream API adds a tool, renames a parameter, or quietly widens what an existing tool can do. None of that goes through the consent screen a human actually looked at, which means connector drift is a security problem, not just a compatibility one.

Govna’s answer is to treat connector discovery as something to snapshot, not trust live. Updates to a connector’s tool list do not silently expand what an existing grant can already reach: a new tool stays hidden until it is explicitly reviewed and added to a snapshot, and a tool whose definition changes is paused rather than carried forward under its old approval (CON-001). The grant a human approved describes a specific, versioned view of the connector — not “whatever this connector happens to expose today.”

This matters most for the tool an agent was never supposed to have. Without versioned snapshots, a connector vendor adding a more powerful sibling to an already-approved tool could expose that new capability the moment a session relies on live discovery of the connection, with no new human decision anywhere in the loop. With snapshotting, that new tool simply does not appear until someone reviews the change and decides it belongs in the next approved snapshot (CON-001). See tool snapshots for how the versioning itself works.

Detection still has a boundary worth stating plainly: the snapshot-and-hide mechanism (CON-001) depends on Govna’s own periodic and on-demand discovery requests to the connector. A behavior change that the connector’s own tool list does not reflect isn’t caught until the next discovery response captures it. Drift protection narrows the gap between “the connector changed” and “a human reviewed the change” — it does not claim to close that gap instantly.