The capability that makes AI agents worth deploying is the same one that makes them hard to trust. They can infer what a user is trying to achieve from incomplete information, fill in missing steps, and act without being directed at every turn. Yet each inference has the potential to move its understanding of the task further from the instruction it received. An agent can act within its permissions and still deliver an unintended outcome, because permission checks validate actions, not intent. This divergence between the agent’s interpretation and the user’s intended objective is intent drift.
The risk grows as agents move beyond a single instruction to combine signals from multiple applications and data sources, reason across that context, and execute multistep workflows. An agent’s behavior depends not only on the AI model, but also on the systems around it: how context is assembled, what memory persists, and how actions are permitted and checked. Competition is shifting beyond raw model capability to the surrounding harness that supplies context and governs execution.
Meta is competing on exactly this ground. Its personal agent, Muse, is built around the user, drawing on past interactions and data across connected applications. Meta also plans to extend Muse’s context sources to the user’s physical environment via AI glasses, enabling it to respond to what the user sees and hears. With Muse among the initial offerings of the Meta Enterprise Platform, Meta is extending its agent strategy to businesses and developers. This expansion makes intent drift a key governance aspect beyond personal AI: in business settings, an agent’s interpretation of an objective can shape decisions and actions with organizational consequences.
Intent drift can emerge at three points: how an agent interprets the context it receives, what it retains and reuses from memory, and how it translates its understanding into action.
Intent drift begins at the input, because an agent rarely acts on the instruction alone. Muse treats what the user types as one signal and combines it with context from several sources to form its own understanding of the task.
What matters is an agent’s ability to combine separate signals into an interpretation that the user did not explicitly provide. Meta’s potential differentiation lies in extending the digital context available to agents with information from the physical environment. For enterprises, however, the same capability creates an audit challenge: it can be difficult to reconstruct which signals shaped an agent’s interpretation. The broader the set of accessible sources, the more deliberate the scope of access must be.
Controlling what an agent can access does not, by itself, control what it retains. Context gathered for one request can persist and shape later decisions, which creates a control problem that access management alone cannot solve. Access control governs whether an agent can retrieve information; memory governance determines what it can retain, how long that information persists, and whether it can be reused in another context. The enterprise question is whether information legitimately obtained for one task should influence another task, interaction, or user. As agents work across applications with less human oversight, the answer has to come from explicit rules for memory scope, reuse, retention, and expiry, rather than being left to the agent’s own judgment.
Persistent memory also raises a privacy concern. Information shared in one interaction may continue to influence later decisions. Meta has introduced several controls in Muse: its conversations are kept separate from its advertising systems, users can control whether their data is used for AI training, and they can ask Muse to forget information.
The context an agent assembles and the memory it retains shape its decisions. When it acts on those decisions, intent drift becomes consequential. Muse separates execution from authorization: a Secure VM isolates the agent’s runtime and data, while the Sentinel agent controls connector actions and outbound network traffic. Muse never sees real credentials, and sensitive actions can require user approval.
These controls limit where the agent can operate and what it can do, but they cannot ensure that its actions reflect the user’s intent. Information encountered during execution can steer an agent with legitimate access toward an unintended outcome. Prompt injection exploits the gap between what an agent is authorized to do and what it is manipulated into doing.
Meta treats prompt injection as a persistent risk of agentic systems rather than a flaw it can train out of the model. Its defenses combine model-level training, handling of untrusted inputs, independent detection classifiers, isolated execution, and human approval checkpoints. Meta has also opened the Muse security program to outside researchers, with rewards of up to $300,000, including up to $130,000 for successful prompt-injection attacks, and it acknowledges that Muse can still make mistakes.
In an enterprise, AI agents can operate across customer records, financial systems, and operational workflows, so a drifted decision can cost far more. The points at which an agent accesses, retains, executes, or exposes information define the trust boundaries enterprises need to govern.
Mapping the agent’s journey onto those boundaries makes the requirements concrete. Context becomes a question of what data the agent can access. Memory becomes a question of what it can retain, infer, and reuse. Action splits into two: where the agent runs, and what it can change or trigger without approval. Enterprise deployment also adds a fifth boundary describing who outside the organization can access or process what the agent handles.
Meta has said that security and privacy are built in from the outset, and Muse’s architecture includes controls relevant to the first four boundaries, including scoped permissions, memory controls, isolated execution, and human approval checkpoints. The remaining question is how these safeguards extend to external entities, particularly through data use terms and technical isolation for sensitive workloads that determine who outside the organization can access or process the information an agent handles.
The same framework applies to every AI agent vendor. Agent red teaming must go beyond model accuracy and access controls to test how injected instructions, misleading context, and persistent memory can push an agent off task. Evaluation must also establish whether resulting actions can be traced back to the user’s intended objective and whether provider-level access and data handling are adequately bounded. The challenge will be ensuring consistency as agents operate across multiple systems with varying levels of autonomy.
Recent developments in agent architectures emphasize leveraging richer contextual information and increasing autonomy. Meta’s latest Muse Wonder models, advance this trend by maintaining user context across conversations, retrieving relevant information as new tasks arise, and adapting strategies to complete complex objectives. While these capabilities enhance agent utility, they also broaden the potential for intent drift as agents exercise greater independent judgment.
For enterprises, controlling access is no longer enough to build trust; they need evidence that the agent stays focused on the task it was given. Because an agent can drift from the user’s intent without breaking any permission, alignment must be tested, not assumed from safeguards. Enterprises will extend autonomy only as far as they can verify that alignment.
The next frontier of agentic AI is not greater autonomy. It is trusted autonomy.
By Abhisekh Satapathy, Principal Analyst, Chandrika Dutt, Research Director, and Saurav Jayant, Senior Research Analyst, Avasant
Avasant’s research and other publications are based on information from the best available sources and Avasant’s independent assessment and analysis at the time of publication. Avasant takes no responsibility and assumes no liability for any error/omission or the accuracy of information contained in its research publications. Avasant does not endorse any provider, product or service described in its RadarView™ publications or any other research publications that it makes available to its users, and does not advise users to select only those providers recognized in these publications. Avasant disclaims all warranties, expressed or implied, including any warranties of merchantability or fitness for a particular purpose. None of the graphics, descriptions, research, excerpts, samples or any other content provided in the report(s) or any of its research publications may be reprinted, reproduced, redistributed or used for any external commercial purpose without prior permission from Avasant, LLC. All rights are reserved by Avasant, LLC.
Login to get free content each month and build your personal library at Avasant.com
