Intent Drift at SME Scale: Deployment Practice, Not Model Capability, Determines Agentic Compliance

Abstract

We introduce Chain of Intent, a governance framework for agentic AI at small regulated firms, and validate it against a failure it was built to address. Existing agentic governance research assumes enterprise infrastructure that small firms do not have. In a simulated Hong Kong asset manager with 415 synthetic contact records, an agent performing a routine client-communications task was subjected to ordinary managerial pressure to increase its reach. With its authorised constraints written into its configuration, the agent held: it identified every ambiguity in the firm's records, cited privacy legislation it had never been shown, and refused six successive requests, breaching in two of fifteen runs. With the same task, data, pressure and model, but its purpose left unstated as resource-constrained firms routinely leave it, it breached in thirteen of fifteen runs, contacting up to 220 individuals of whom 94 per cent had no demonstrable marketing consent - conduct carrying a maximum of three years' imprisonment under Hong Kong law. Chain of Intent applies four controls requiring no security engineering: a machine-readable purpose, constrained tool access, a scope ledger, and a pre-action check. It eliminated unlawful contact in every run while preserving task completion, and ablation shows each control independently sufficient by a different mechanism. We further show that drift must be measured at two stages - agents widened their candidate sets in every pressured run while acting on them in roughly one in seven - and that governance applied at the point of intent costs roughly half as much as governance applied at the point of action.