From Admission to Invariants: Measuring Deviation in Delegated Agent Systems

Autonomous agent systems are governed by enforcement mechanisms that flag hard constraint violations at runtime. The Agent Control Protocol (ACP) identifies a structural limit of such systems: a correctly-functioning enforcement engine can enter a regime in which behavioral drift is invisible to it, because the enforcement signal operates below the layer where deviation is measurable. We show that enforcement-based governance is structurally unable to determine whether an agent's behavior remains within the admissible behavior space established at admission time. Our central result, the Non-Identifiability Theorem, proves that the sigma-algebra generated by the enforcement signal does not contain the admissible behavior space under the Local Observability Assumption — which every practical enforcement system satisfies. The impossibility arises from a fundamental mismatch: the enforcement signal evaluates actions locally against a point-wise rule set, while the admissible behavior space encodes global, trajectory-level behavioral properties set at admission time. We then define the Invariant Measurement Layer (IML), which bypasses this limitation by retaining direct access to the generative model of the admissible behavior space. We prove an information-theoretic impossibility for enforcement-based monitoring; separately, we show that IML detects admission-time drift with provably finite detection delay, operating in the region where enforcement is structurally blind. Key results: - Non-Identifiability Theorem: enforcement-based monitoring cannot identify behavioral drift from enforcement signals alone. - IML detects drift with finite detection delay, formally bounded. - Validated across four experimental settings: three controlled drift scenarios (300 and 1000 steps), a live n8n webhook pipeline, and a LangGraph StateGraph agent with deterministic tool selection. - In every case, enforcement triggers zero violations while IML deviation grows monotonically, detecting each drift type within 9–258 steps of drift onset. This paper is Paper 2 of a 6-paper Agent Governance Series: P0 — Atomic Decision Boundaries (structural foundation). P1 — Stateful enforcement via ACP. P3 — Fair multi-agent allocation under shared governance infrastructure. P4 — Composition irreducibility: the four-layer architecture is structurally necessary. P5 — Runtime execution validity under partial observability (RAM). Full series (Agent Governance Series, Papers 0–5): P0 — Atomic Decision Boundaries: https://doi.org/10.5281/zenodo.19642166 P1 — Agent Control Protocol (ACP): https://arxiv.org/abs/2603.18829 | https://doi.org/10.5281/zenodo.19642405 P2 — From Admission to Invariants (IML, this paper): https://doi.org/10.5281/zenodo.19643761 P3 — Fair Atomic Governance: https://doi.org/10.5281/zenodo.19643928 P4 — Irreducible Multi-Scale Governance: https://doi.org/10.5281/zenodo.19643950 P5 — Reconstructive Authority Model (RAM): https://doi.org/10.5281/zenodo.19669430