Definition
The gap that opens when what a system does moves away from what it was granted permission to do or what its evidence supports. Drift arrives through added integrations, widened inputs, quietly raised thresholds, and habits that outlive the exception that created them, and it accumulates through the automation ratchet.
It matters because every individual step looks too small to review. Drift is detected by comparing observed action classes from capability discovery against grant scope, and it is what justified delegation and the authority lease exist to catch.
PatternsDiagnosticStructural
Tests that show it is in place
- Observed action classes are reconciled against grant scope on a stated cadence.
- Exceptions granted during incidents carry an expiry and are reconciled after the incident closes.
- A widening that no one authorized appears in the reconciliation report rather than in a postmortem.
Evidence to keep
- Artifact: A reconciliation report listing observed action classes not covered by any live grant.
- Behavior: An unauthorized integration disabled after appearing in reconciliation.
- Metric: Count of ungrounded action classes per reconciliation cycle, trended.
- Threshold: Target zero; any nonzero count opens a review.
References
- Expansion eval · Eval