The Governance Half-Life of Agentic Artificial Intelligence Controls: A Dynamic Assurance Framework for Control Decay, Residual Risk, and Revalidation

Abstract

Agentic artificial intelligence can plan, use tools, communicate with other systems, and execute actions across changing environments. Its governance problem is therefore temporal: a control that was adequate at deployment may become materially weaker after model updates, data drift, new tool permissions, adversarial adaptation, staff turnover, or regulatory change. This paper develops the governance half-life construct to measure the rate at which an artificial intelligence control loses effective coverage after validation. Using an integrative multidisciplinary review and design-science theory building, the study combines artificial intelligence risk management, software reliability, cybersecurity, human factors, organizational learning, and regulatory governance. The proposed model represents control effectiveness as a decaying function, derives a governance half-life and a maximum risk-tolerable revalidation interval, and combines scheduled, event-triggered, and continuous assurance. A worked analytical demonstration shows why low-risk knowledge agents may tolerate periodic review while transaction, eligibility, and safety-relevant agents require much shorter assurance cycles. The framework contributes a control-decay ledger, portfolio-level aggregation, testable propositions, and an implementation maturity model. It shifts governance from one-time approval and annual audit toward risk-sensitive evidence renewal. The framework is intended for empirical calibration rather than treated as a universal numerical standard, but it offers organizations a practical way to align agent autonomy, control durability, residual risk, and revalidation cadence.