DriftGuard watches
how your agent does it.
CleverGuard catches attacks. ScopeGuard catches out-of-scope requests. ClaimGuard catches hallucinations. DriftGuard catches a fourth failure mode: an agent doing its approved job, differently than it used to.
Layer 4 of four. Arms on governed agents once a behavioral baseline has locked.
Baseline, last 30 days
send_email 3 / day read_inbox 40 / day sessions 12 / day destinations internal only
Today
send_email 380 / day new external domain: evil-corp.com
- BaselineLocked after 10 calls. Tracks tools, destinations, token size, time of day, modality, sensitivity, PII.30 days
- DriftGuardVolume drift: baseline 3 / day, observed 380 / day. New destination.vs 30-day baseline
- VerdictCritical. Token suspended; resume requires human review.enforce
Enforce mode suspended the token the same day. Nothing ran again until a human reinstated it. A representative verdict, not a live event feed.
The behavioral signals DriftGuard targets.
None of these require the agent to violate a scope rule. Each one is a pattern that looks normal on any single call and only becomes a signal across the session or across time. All of them run against live traffic once an agent’s baseline has locked; until then DriftGuard only observes.
The demo agent generates roughly 10 drift.critical and drift.auto_restrict events per hour via a 60-second-cadence test workflow.
Tool-distribution drift
Tracks which tools an agent calls and in what proportion. A sudden shift, such as more email sends and fewer reads, is flagged even if every tool is on the approved list. Distribution changes often precede exfiltration or abuse.
Volume, cost, and session drift
Baseline call rates, token spend, and session length per agent. A weekly scheduler that suddenly runs 400 calls in a day hasn't gone out-of-scope. It's out of character. DriftGuard catches the difference.
Bigram and sequence drift
Models the typical sequences of tool calls an agent makes. A normal email summarizer goes: list → fetch → summarize. If it starts going: list → fetch → send → fetch → send, the sequence is anomalous regardless of whether each step is allowed.
Session anomaly
Tracks session-level patterns: how many sessions per hour, how many tool calls per session, how much time per step. Outlier sessions are flagged individually, not averaged away.
Depth and temporal anomaly
Some agents have predictable timing signatures: they run on a schedule, during business hours, in short bursts. DriftGuard models this and flags sessions that arrive at unexpected times or run unusually long.
Prompt rewrite detection
Compares the structure of each incoming system prompt against the baselines learned from the agent's own early calls. A prompt that carries the agent's CNK token but replaces most of its instruction set is rejected with HTTP 429 and the CleverGuard session is paused; smaller edits raise an alert. A semantically dangerous but textually small edit, like negating one rule or appending one sentence, scores below the threshold and only alerts.
Questionnaire contradiction
Checks runtime behavior against the agent's approved mandate from the Agent Review questionnaire. If the agent was approved for read-only access but is now writing, DriftGuard surfaces the contradiction even if ScopeGuard didn't block the call.
Three ways to respond to drift.
Start in observe mode while the baseline learns. Graduate to flag once you’re confident in the signal. Switch to enforce for high-autonomy agents that shouldn’t wait for human review.
ObserveSilent
DriftGuard builds and refines the behavioral baseline without surfacing any findings. Use this mode during the learning period or for sensitive agents where you want visibility before enforcement. All drift events are logged to your audit trail.
FlagWarn
Drift events above threshold are surfaced as alerts in your audit trail and optionally forwarded to Slack or your SIEM. The agent is not stopped. You decide what to do. Use flag mode once the baseline has converged and you're comfortable with the signal quality.
EnforceAuto-restrict
Critical drift events automatically suspend the agent's CNK token. The agent stops calling tools until a human reviews the alert and explicitly resumes it. For high-autonomy agents (schedulers, data pipelines, outbound workflows), enforce mode provides a hard circuit breaker.
What DriftGuard does not do.
DriftGuard tells you what changed. It does not tell you why.
Does not replace ScopeGuard
ScopeGuard enforces what tools an agent is allowed to call on every request. DriftGuard tracks how those approved tools are being used over time. They catch different failure modes and both need to be on for full coverage.
Statistical signals need a learning period
The statistical signals (volume, distribution, sequence) need a learning period before the baseline locks, and drift is logged rather than alerted until it does. System-prompt rewrite detection is the exception: it is armed as soon as the first prompt is seen and can reject a request from the second call onward.
Does not model intent
DriftGuard catches behavioral changes. It doesn't determine whether those changes are malicious, accidental, or the result of a legitimate update. When it fires, a human reviews the session and decides. DriftGuard provides the signal; you provide the judgment.
Does not catch prompt injection
Injection defence is CleverGuard's job. DriftGuard does inspect the system prompt on each request and rejects wholesale rewrites, but it will not catch an injection that leaves most of the approved mandate intact. The two guards are additive: CleverGuard scans the input before the agent sees it; DriftGuard watches what the agent does after.
Every guard runs through one gateway, on your own keys.
CleverGuard on every call. ScopeGuard on governed agents. ClaimGuard on responses. DriftGuard on behavioral baselines. Free tier covers all four.