Chapter 19. Drift Triage

Eight categories, what each means, who owns it, and how to respond without drowning in alerts.

19.1 The eight categories

Table 52.

Two categories from earlier drafts were deliberately removed. Capability drift — a business capability’s actual maturity diverging from its recorded state — is not observable by an API call and is handled by periodic capability re-baselining. Strategic drift — enterprise strategy changing such that approved architecture no longer aligns — requires human judgment, not comparison, and is handled by periodic intent review. Claiming either as telemetry-detectable would overstate what the mechanism can do.

19.2 The two meanings of “data drift”

This distinction prevents a recurring misrouting.

Statistical distribution shift in a model’s input data is a model-performance concern. It belongs to Technical AI Evaluation and appears here as category 6, AI-Model Behavioral drift.

Ungoverned change to grounding sources is an architecture and lineage concern. It is category 5.

Conflating them means an architecture drift alert fires for a model-quality issue, or a model-quality signal is routed to an architect who cannot act on it. Keeping them separate is one of the framework’s few original mechanisms, and its value is diagnostic: when an AI system’s behavior changes, the first question is whether the model changed or its grounding changed, and separated signals answer it immediately.

19.3 Policy and regulatory drift is structurally different

Categories 1 to 6 and 8 detect actual state diverging from approved state. Something moved on the ground.

Category 7 detects the opposite: approved state no longer satisfying an external requirement that itself changed, with nothing about the system having moved at all. A system can become non-compliant overnight without a single deployment.

This requires a different mechanism — a regulatory and policy monitoring feed into Evaluate, not a telemetry comparison. [Practice recommendation] Maintain the Regulatory Overlay Reference as a live record mapping each applicable regime to the systems it touches, and treat a change in any mapped regime as a drift event that re-opens the affected systems’ compliance assurance. Without that mapping, regulatory change requires someone to remember which systems are affected.

19.4 Triage: severity and routing

Severity is a function of the drift category and the affected system’s tier, not of the category alone.

Table 53. Triage: severity and routing

Agent boundary divergence is the exception to this table: treat it as an incident at any tier (Chapter 17, §17.3).

19.5 Managing alert volume

A Control Plane that produces more alerts than the organization can act on trains people to ignore it, which is worse than having no Control Plane because it creates a false sense of coverage.

Four practices keep volume tractable.

Start narrow. Two or three telemetry sources against the Tier 3–4 estate produces a volume a small team can absorb and learn from.

Report-only first. Every new comparison runs in report-only mode for a cycle. The initial volume tells you whether your approved-state records are accurate; a flood usually means the records are wrong, not that the estate is.

Suppress known-and-accepted, visibly. Where drift is accepted, it becomes a recorded exception with an expiry, not a suppressed alert. Suppression without a record is how coverage silently erodes.

Use the Learn function. A pattern generating repeated drift across multiple initiatives is a pattern problem, not a compliance problem. Route it to pattern-library maintenance rather than raising the same finding repeatedly against different teams. This is the loop that conventional periodic governance cannot close.

19.6 From drift to decision

A drift signal is not a decision. The path from one to the other has four possible endpoints, and making them explicit prevents alerts accumulating in an unresolved state.

Table 54. From drift to decision

[Practice recommendation] Enforce a maximum age for open drift findings by tier, and report the aged backlog. Unresolved drift is the clearest available measure of whether governance is keeping pace with delivery.