The workflow execution and the model instruction are separate versions. Pinning workflow code does not automatically pin what the next model call sees. But pinning Monday's prompt forever can also allow a refund Friday that today's policy forbids. We need to separate behavior needed to replay and explain past decisions from authority for a new external action.

I would record an instruction bundle ID at each reasoning step. It includes prompt text or digest, tool contracts, model and policy references, and any context transformation version. The old plan is evidence of what the agent intended under Monday's bundle, not a grant to act on Friday. At a durable resume boundary, load current authority and compare the planned action with current policy. If the approval rule changed, invalidate or revise the pending refund proposal and ask for the new approval. Keep the old bundle available for audit so we can explain why the earlier plan was made. Do not quietly present a new prompt as if it had produced the old plan.

For a long-running workflow engine, code versioning can protect replay of the workflow itself. Temporal's worker versioning documentation addresses compatibility of running executions with worker deployments. It does not decide when a business prompt or authorization rule should change for a pending action. That is an application boundary.

I would define explicit migration classes. Wording and formatting changes can often take effect at the next model call. Tool schema changes require an adapter or a new plan because pending tool arguments may no longer mean the same thing. Policy-tightening changes apply before any new action submission, even if the old conversation summary says the action was allowed. Changes to a model's reasoning style can be tested with shadow continuation before applying to thousands of waiting cases. Already submitted refunds remain in an effect ledger and must be reconciled. Replanning cannot make them unsent.

What if the user has been promised a refund under the old rule? That is a business commitment question. A human may need to honor it under a special, recorded authorization. The agent should not decide that an old prompt is the authority. The case state should retain the promise, actor, time and evidence, and the current policy service decides whether an exception applies.

Test a wake-up after each type of change, including pending approvals, tool arguments and an unknown provider outcome. Compare the exact old and new bundle IDs in traces. How do you deploy new agent workflow code while 200,000 runs are waiting? covers deploying workflow code while runs wait. A long conversation summary dropped 'never call delete'. Where should that rule live? covers losing a rule during summarization. Here a rule changes intentionally while the workflow is alive, and the design has to preserve both historical explanation and current action safety.