Your Change Freeze Starts in Two Weeks. Your Agents Didn't Get the Memo.

Sometime in the next two weeks, someone in your org will send the email. You know the one. Production change freeze in effect November 15 through January 5. No non-critical deploys. Exceptions require director approval. The calendar invite goes out, the spreadsheet of exception requests is born, and everyone exhales a little — because if nothing changes, nothing breaks.

That premise has kept retail infrastructure alive through two decades of Cyber Mondays. It has one problem this year: it doesn't apply to the systems most likely to do something strange in December.

Your agents don't observe the freeze. Not because anyone exempted them — because the freeze can't reach the things that actually change their behavior.

What a freeze actually freezes

A change freeze governs your deploy pipeline: code, configs, infrastructure. It works because for conventional software, behavior is a function of the artifact you shipped. Pin the artifact, pin the behavior.

An agent's behavior is a function of the model, the prompt, the tools it can reach, and the context it accumulates. Your freeze controls, at best, one and a half of those. The rest keep moving — three ways in particular.

1. The model changes without you

Your vendor ships new weights on their schedule, not yours. Version pinning helps less than you'd hope: providers deprecate pinned versions and force migrations, and research has documented behavioral shifts even under stable version identifiers. The canonical example is the Stanford and Berkeley study that tracked GPT-4 across two snapshots three months apart and watched accuracy on one task fall from 84% to 51%. Same product name. Same API. Different behavior.

There is no row in your freeze calendar for "foundation model vendor updated the weights behind our pinned endpoint." There never will be. It's not your change to freeze.

2. The context changes without a deploy

Agents pick up behavioral changes through channels your pipeline never sees. An MCP tool you depend on updates server-side — new description, new parameters, new behavior — and your agent dutifully adapts. Your retrieval corpus grows. Agent memory accumulates across sessions, which is exactly why memory poisoning outlives the session. None of this files an exception request. None of it shows up in the deploy log, because there was no deploy.

3. The traffic changes — this season, dramatically

Here's what makes November different from a normal month of unfrozen agent drift: the input distribution is about to go vertical.

Adobe forecasts a record $275.1 billion in U.S. online holiday spend this season, up 6.7% — with traffic referred by AI sources up 130% year over year. Salesforce projects that 20% of all holiday ecommerce traffic will come from AI agents, and that one in three ecommerce sites will have a site-specific shopper agent live by Cyber Week.

Translation: whether you sell things or buy things, your agents are about to meet their strangest, highest-volume input mix of the year — precisely when your staffing is thinnest and your ability to ship a fix is formally suspended.

The platforms have noticed. Walmart shipped Agent Profiles and an Agent Gateway in late October, with per-agent spending limits and purchase histories. Amazon blocked Meta's shopping agent outright. When the two largest retailers in America spend the weeks before Black Friday building admission policy for agents, that's not a product announcement. That's a weather report.

You can't freeze the model. You can freeze the blast radius.

The freeze is still correct — it's just incomplete. Deploy control is the wrong instrument for systems whose change surface sits outside your pipeline. The right instrument is runtime posture that tightens with the calendar. Four moves, in order of urgency:

Ratchet your policy tiers for the window. A trust threshold that's fine in March is not fine on Cyber Monday. Gate's policy tiers let you tighten by schedule: raise the trust score required for high-impact actions, route more decisions to review, drop your anomaly tolerance for the duration. Humans get a freeze exception process; agents should get a stricter autonomy tier. Same logic, enforced in milliseconds instead of meetings.

Baseline now, diff daily. You can't diff your vendor's weights, but you can diff your agent's behavior. Capture a pre-freeze behavioral baseline — event mix, action rates, error and refusal patterns — through Gate's event ingestion, and alert on deviation. That's how you catch the mid-December model update your vendor didn't headline: not in the changelog, in the behavior.

Drill the kill switch before Thanksgiving. An emergency stop you've never exercised is a hypothesis, not a control — we've written about why most kill switches fail when first used in anger. Guard's kill switch is built for this, but run the drill while your senior engineers are at their desks, not on December 24th at 11pm.

Put freeze exceptions on the ledger. Every freeze generates exceptions, and agent-related exceptions are the ones January's postmortem will ask about. Route them through Vault's hash-chained audit trail and the answer to "what changed, when, approved by whom" is a verifiable ledger — not Slack archaeology across three channels and a deleted thread.

The freeze email is coming. Get ahead of it.

Change freezes assume that control over deployment equals control over behavior. Agents broke that equation, and peak season is when the gap gets expensive. The fix isn't a longer freeze — it's governance that operates at runtime, where agent change actually happens.

Gate is free and always on: trust scoring, policy tiers, and behavioral event ingestion from your first agent onward. Baseline your fleet this week, tighten the tiers before the window opens, and when someone asks whether the agents are covered by the freeze, you'll have a better answer than "define covered."

Start with Gate — before the freeze email goes out.