From Admission to Invariants: Measuring Deviation in Delegated Agent Systems