-
Notifications
You must be signed in to change notification settings - Fork 4
Adaptation Is Change Control
Your agent can improve without anyone deploying anything. Your change control cannot see that.
Jiang, P., Lin, J., Shi, Z., et al. (2025). Adaptation of Agentic AI. arXiv:2512.16301v1 [cs.AI], 18 December 2025. https://arxiv.org/abs/2512.16301 · companion repository: https://github.com/pat-jj/Awesome-Adaptation-of-Agentic-AI
The taxonomy below is theirs. The CoE mapping is ours. The paper is licensed CC BY-NC-ND, so nothing from it is reproduced here: no tables, no figures, no quoted text. The four categories are described in our own words at concept level. For the comparison itself, and for the evidence behind it, read the paper.
A production agent is a change-controlled asset. It has an owner, a risk tier, a card, a set of gates, and a drift check.
All of that assumes one thing: the agent is what changes when someone deploys a change.
Agentic systems break that assumption twice over.
An agent can improve with no deployment event at all. From feedback its tools return, from judgements about its own output, from a memory that rewrites itself.
And the thing that improved may not be the agent. It may be a retriever, a subagent, or a memory store sitting underneath a model nobody touched.
So the governance question is not did the agent change? It is:
What changed, what signal changed it, and who would have known?
The taxonomy below answers the first half cleanly. The second half is the CoE's job, and it is the rest of this page.
Two questions produce four answers.
First: what is being optimised, the agent or its tools?
Second, if it is the agent: what signal is doing the optimising?
Second, if it is the tools: is the agent involved in that optimisation at all?
| What changes | What drives it | What it amounts to | |
|---|---|---|---|
| A1 | The agent | Verifiable results from the tools it calls: did the code run, did the query retrieve, did the call succeed | The agent is learning to use its tools. Mechanics |
| A2 | The agent | Judgements about its own finished output: was the answer right, was the plan good | The agent is learning strategy. Outcomes |
| T1 | A tool | Something entirely separate. The tool was trained on its own, by someone else, and dropped in | A component swap |
| T2 | A tool | The frozen agent's own output, used as the training signal for the tool underneath it | The system tunes itself around a model nobody touched |
T2 is the one worth reading twice. There is no deployment, no new model, and no change to the agent. The system is teaching itself, continuously, using its own output as the teacher.
This is the page's own contribution and it is not in the paper.
What in our environment is currently teaching this agent, and is any of it irreversible?
An agent learning from tool execution is learning by trying things. In a sandbox that is training. Against a production system with real side effects it is exploration with a blast radius.
The card must record: which tools produce a learning signal, and which of those tools take irreversible actions. Those two lists overlapping is the finding.
If it gets the right answer for the wrong reason, does our reward tell us?
Judging only the final output means the agent can improve its scores without improving its process. This is the Production Gate Question arrived at from a different direction, which is a good sign that both are pointed at something real.
The card must record: what the outcome metric is, what it does not see, and the last date anyone checked the two apart.
When the tool underneath was replaced, what re-ran?
A dropped-in component is invisible to agent-level change control. Nothing about the agent changed, so nothing triggered. The retriever is a different retriever and every gate the agent passed was passed by a system that no longer exists.
The card must record: every tool by version, and which golden-dataset run each version was last evaluated against.
What is writing to memory, and what happens when it writes something wrong?
The category with no deployment event. The system improves continuously using its own output as the teacher, which means a wrong output becomes tomorrow's training signal.
The card must record: the write path, the retention policy, and whether the memory can be rolled back to a known-good state. If it cannot be rolled back, that is not a memory, it is an accumulating liability.
Both stated as our conclusions rather than as the paper's claims.
Adaptation without a verifier drifts toward whatever is easy to score.
When the reward is a proxy rather than the real thing, a capable system finds the proxy. That is not a new observation, and it lands differently for agents: an agent with tool access can change the world in order to score better on it.
The response is the same as everywhere else in this repo. Verifiable outcomes rather than preference scores, and a golden dataset the agent did not build.
When two things adapt to each other, neither one is stable.
A tool tuned to a model and a model tuned to that tool can chase each other indefinitely without either getting better.
Practically: never let two adaptive components co-adapt without one of them pinned. Pin the model or pin the tool, and change one at a time.
Nothing above changes what the Agent Card asks for. It changes what "unchanged" means.
An agent whose card has not been touched in six months may be a stable asset. It may also be a system that has been quietly retraining a retriever underneath itself the entire time. The card cannot tell those apart today.
That is the gap. Adding a what adapts, and on what signal line to the card closes it.
Taxonomy: Jiang, Lin, Shi et al., Adaptation of Agentic AI, arXiv:2512.16301v1 [cs.AI], 18 December 2025, CC BY-NC-ND. Cited and linked; nothing reproduced. The gate questions, the card requirements and the two conclusions are original to this repo.
The thinking
Operating model
Frameworks
Governance
Playbooks
Value and people
Reference
In the repository
The courses
Reviewed 2026-08.