When was the last time a routine change to a control broke something nobody expected it to protect?
Security teams know that moment. Something stops working that was never supposed to be working in the first place.
Accidental governance is the working term for this pattern: security coverage that exists as an unintended side effect of controls designed for something else.
This pattern has existed in cybersecurity for decades. It was never consequential enough to name because when a control constrains a human, the human notices.
When a control stops constraining an agent, the agent just keeps going. It starts succeeding at things it was not supposed to be able to do, and the environment cannot tell the difference.
The next routine change to that control may be the one that removes it.
For CXOs: Which of your current controls are carrying agent risk they were not designed for?
For boards: When a control is changed for its original purpose, what process surfaces the unintended coverage it was also providing?