# How connector drift changes an agent’s permission surface

An upstream tool list is not static, and a governed grant has to treat that as a security fact, not a convenience.

Author: Govna
Published: 2026-08-23
Updated: 2026-08-23

Evidence:
- [CON-001](https://govna.io/solutions/security-leaders#CON-001)

An agent's permission surface is not just the grant a human approved — it is
also whatever the connector on the other end of that grant currently exposes.
Connectors change. An upstream API adds a tool, renames a parameter, or
quietly widens what an existing tool can do. None of that goes through the
consent screen a human actually looked at, which means connector drift is a
security problem, not just a compatibility one.

Govna's answer is to treat connector discovery as something to snapshot, not
trust live. Updates to a connector's tool list do not silently expand what an
existing grant can already reach: a new tool stays hidden until it is
explicitly reviewed and added to a snapshot, and a tool whose definition
changes is paused rather than carried forward under its old approval
([CON-001](/solutions/security-leaders#CON-001)). The grant a human approved describes a
specific, versioned view of the connector — not "whatever this connector
happens to expose today."

This matters most for the tool an agent was never supposed to have. Without
versioned snapshots, a connector vendor adding a more powerful sibling to an
already-approved tool could expose that new capability the moment a session
relies on live discovery of the connection, with no new human decision
anywhere in the loop. With snapshotting, that new tool simply does not appear
until someone reviews the change and decides it belongs in the next approved
snapshot ([CON-001](/solutions/security-leaders#CON-001)). See
[tool snapshots](/glossary) for how the versioning itself
works.

Detection still has a boundary worth stating plainly: the snapshot-and-hide
mechanism ([CON-001](/solutions/security-leaders#CON-001)) depends on Govna's own periodic and
on-demand discovery requests to the connector. A behavior change that the
connector's own tool list does not reflect isn't caught until the next
discovery response captures it. Drift protection narrows the gap between
"the connector changed" and "a human reviewed the change" — it does not
claim to close that gap instantly.