CAIN Drift PRODUCTION

Detect meaningful changes in agents, models, tools, policies, data, behavior, and compliance state before drift becomes an incident.

Architecture

📊

Data Drift

PSI, JS, KS, Chi-Square, Mean Shift, Variance Ratio

🤖

Model Drift

Provider, Version, Configuration Fingerprints

🔧

Tool Drift

Schema, Permissions, Capabilities Diff

📋

Policy Drift

Version, Rules, Risk Threshold Changes

👤

Behavior Drift

Action Frequency, Tool Selection, Trajectories

🔒

Security Drift

Threat Events, Injection, Blocked Actions

✓

Compliance Drift

Posture Score, Control Impact, Findings

⚙️

Config Drift

Agent, Runtime, Endpoint Configuration

Capabilities

📊

Statistical Methods

Population Stability Index (PSI), Jensen-Shannon Divergence, Kolmogorov-Smirnov Test, Chi-Square, Mean Shift, Variance Ratio, Quantile Shift, Cardinality Change, Missingness Shift. Every result includes baseline, comparison, metric, baseline_value, current_value, delta, threshold, confidence, sample_size, method, severity.

🔍

Structured Diff

Explain exactly WHAT changed, not just "something changed". Tool schema widening, permission scope expansion, input/output schema changes, version updates. Full before/after comparison.

⏱️

Deterministic Severity

CRITICAL, HIGH, MEDIUM, LOW severity with explainable reasoning. Severity is calculated from change type, affected systems, trust impact, compliance impact. Do not invent severity.

🔗

Integration

Uses existing CAIN infrastructure: Observability (events, runs), Evidence (audit), Trace (execution), Trajectory (action sequences), Memory, Compliance, Governance, Security. Does NOT create duplicate infrastructure.

📋

Lifecycle Management

DETECTED → ACKNOWLEDGED → INVESTIGATING → MITIGATED → RESOLVED → ACCEPTED → FALSE_POSITIVE. Every state transition produces evidence and records actor, timestamp, reason, correlation_id.

API Endpoints

GET /fabric/drift/health 200

Drift service health check with detector status

GET /fabric/drift/status 200

Overall drift status for tenant (last check, counts by severity)

GET /fabric/drift/stats 200

Drift statistics (total findings, by_severity, by_class, by_status, avg_confidence, avg_delta)

POST /fabric/drift/baselines 200

Create drift baseline (entity_id, entity_type, drift_class, baseline)

GET /fabric/drift/baselines 200

List baselines (filter by entity_type, drift_class)

GET /fabric/drift/baselines/{id} 200

Get specific baseline

POST /fabric/drift/observe 200

Observe current state and detect drift against baseline

POST /fabric/drift/compare 200

Explicitly compare current state against baseline

GET /fabric/drift/findings 200

List drift findings (filter by drift_class, severity, status, since)

GET /fabric/drift/findings/{id} 200

Get specific drift finding

POST /fabric/drift/findings/{id}/acknowledge 200

Acknowledge finding (detected → acknowledged)

POST /fabric/drift/findings/{id}/investigate 200

Mark as investigating (acknowledged → investigating)

POST /fabric/drift/findings/{id}/resolve 200

Resolve finding (investigating → resolved)

POST /fabric/drift/findings/{id}/accept 200

Accept finding as acceptable risk

POST /fabric/drift/findings/{id}/false_positive 200

Mark as false positive

GET /fabric/drift/agents/{id} 200

Get drift status for specific agent

GET /fabric/drift/impact/{id} 200

Get impact assessment (affected systems, recommended responses, governance requirements)

CLI Commands

cain drift status --json

Get overall drift status

cain drift baselines --json

List all baselines

cain drift create-baseline --entity-id tool_001 --entity-type tool --drift-class tool_drift

Create a new baseline

cain drift observe --entity-id tool_001 --entity-type tool --resource-type tool

Observe and compare against baseline

cain drift findings --severity high --json

List findings with filters

cain drift inspect {drift_id} --json

Inspect specific finding

cain drift impact {drift_id} --json

Get impact assessment

cain drift acknowledge {drift_id} --reason "Acknowledged for review"

Acknowledge finding

cain drift resolve {drift_id} --reason "Tool schema updated intentionally"

Resolve finding

MCP Tools

drift_status

drift_create_baseline

drift_observe

drift_compare

drift_findings

drift_inspect

drift_impact

drift_acknowledge

drift_resolve

Verification

Live Drift Detection Demo

This demo shows a real drift detection workflow with actual API calls.

Create Baseline

Observe

Detect

Evidence

Display

Evidence Integration

Every drift detection produces:

drift_id - unique identifier
correlation_id - links to CAIN Observability events
evidence_id - links to CAIN Evidence Fabric
timestamp - when detected
actor - what detected (cain_drift)

Compliance Integration

✓

Compliance Impact Analysis

Drift can trigger compliance reassessment. Flow: DRIFT → CONTROL IMPACT → EVALUATION → FINDING → EVIDENCE. Drift means "reassessment may be required." Compliance determines the actual control result. Do not mark non-compliant merely because drift occurred.

Truthful Status

Feature	Status	Notes
Drift Detection Engine	OPERATIONAL	10 drift classes implemented
Drift API	OPERATIONAL	All endpoints return 200
Baseline Management	OPERATIONAL	Create, retrieve, list, compare, activate, archive
Finding Lifecycle	OPERATIONAL	Full state machine: detected→acknowledged→investigating→mitigated→resolved/accepted/false_positive
Observability Integration	OPERATIONAL	Events emit to CAIN Observability via record_event
Evidence Integration	OPERATIONAL	Evidence IDs wired to CAIN Evidence Fabric with full chain (baseline, observation, comparison, finding)
Compliance Integration	OPERATIONAL	Compliance findings created via CAIN Compliance; drift triggers reassessment NOT automatic failure
CLI	PARTIAL	Commands defined, may need implementation
MCP Tools	PARTIAL	Tools defined, may need implementation
SSE Stream	PARTIAL	Events emit via observability; real-time stream via Redis not yet implemented
Portal Panel	OPERATIONAL	Product registered in catalog at /service/caindrift

Quick Reference

Drift Classes

Severity Levels

Lifecycle States

Statistical Methods

CAIN Drift is part of CAIN Trust Fabric. It detects meaningful changes in autonomous AI systems using existing CAIN infrastructure (Observability, Evidence, Trace, Trajectory, Memory, Compliance, Governance, Security). Every drift event flows through CAIN Observability. Every consequential response goes through Governance. Every finding produces Evidence.