DriftGuard watches how your agent does it.
CleverGuard catches attacks. ScopeGuard catches out-of-scope requests. ClaimGuard catches hallucinations. DriftGuard catches a fourth failure mode: an agent doing its approved job — differently than it used to.
Live demo traffic
The demo agent generates roughly 10 drift.critical and drift.auto_restrict events per hour via a 60-second-cadence test workflow. A representative enforce-mode verdict:
{
"event": "drift.auto_restrict",
"level": "critical",
"signal": "volume_drift",
"baseline_rate": 3,
"observed_rate": 380,
"window_minutes": 60,
"agent_suspended": true,
"resume_requires": "human_review"
}Illustrative example — a representative enforce-mode verdict, not a live event feed.
The behavioral signals DriftGuard targets.
None of these require the agent to violate a scope rule. Each one is a pattern that looks normal on any single call and only becomes a signal across the session or across time. Tool-distribution drift runs against live traffic today; the remaining signals roll out as each agent’s behavioral baseline converges.
Tool-distribution drift
Tracks which tools an agent calls and in what proportion. A sudden shift — more email sends, fewer reads — is flagged even if every tool is on the approved list. Distribution changes often precede exfiltration or abuse.
Volume, cost, and session drift
Baseline call rates, token spend, and session length per agent. A weekly scheduler that suddenly runs 400 calls in one hour hasn't gone out-of-scope — it's out of character. DriftGuard catches the difference.
Bigram and sequence drift
Models the typical sequences of tool calls an agent makes. A normal email summarizer goes: list → fetch → summarize. If it starts going: list → fetch → send → fetch → send, the sequence is anomalous regardless of whether each step is allowed.
Session anomaly
Tracks session-level patterns: how many sessions per hour, how many tool calls per session, how much time per step. Outlier sessions are flagged individually, not averaged away.
Depth and temporal anomaly
Some agents have predictable timing signatures — they run on a schedule, during business hours, in short bursts. DriftGuard models this and flags sessions that arrive at unexpected times or run unusually long.
Prompt rewrite detection
Compares the structural fingerprint of incoming system prompts against the agent's known baseline. A prompt that appears to be the same agent's CNK token but carries a substantively different instruction set triggers a rewrite alert.
Questionnaire contradiction
Checks runtime behavior against the agent's approved mandate from the Agent Review questionnaire. If the agent was approved for read-only access but is now writing, DriftGuard surfaces the contradiction even if ScopeGuard didn't block the call.
Three ways to respond to drift.
Start in observe mode while the baseline learns. Graduate to flag once you’re confident in the signal. Switch to enforce for high-autonomy agents that shouldn’t wait for human review.
Observe
SilentDriftGuard builds and refines the behavioral baseline without surfacing any findings. Use this mode during the learning period or for sensitive agents where you want visibility before enforcement. All drift events are logged to your audit trail.
Flag
WarnDrift events above threshold are surfaced as alerts in your audit trail and optionally forwarded to Slack or your SIEM. The agent is not stopped — you decide what to do. Use flag mode once the baseline has converged and you're comfortable with the signal quality.
Enforce
Auto-restrictCritical drift events automatically suspend the agent's CNK token. The agent stops calling tools until a human reviews the alert and explicitly resumes it. For high-autonomy agents — schedulers, data pipelines, outbound workflows — enforce mode provides a hard circuit breaker.
What DriftGuard does not do
Does not replace ScopeGuard
ScopeGuard enforces what tools an agent is allowed to call on every request. DriftGuard tracks how those approved tools are being used over time. They catch different failure modes and both need to be on for full coverage.
Does not flag on first anomaly
The baseline requires a learning period before it locks. During observe mode, drift is logged but not surfaced as alerts. The baseline graduation threshold is configurable — enterprise agents can seed directly to enforce mode from day one.
Does not model intent
DriftGuard catches behavioral changes — it doesn't determine whether those changes are malicious, accidental, or the result of a legitimate update. When it fires, a human reviews the session and decides. DriftGuard provides the signal; you provide the judgment.
Does not catch prompt injection
Injection attacks are CleverGuard's job. DriftGuard focuses on behavioral patterns that emerge across many calls — not the content of any individual request. The two guards are additive: CleverGuard scans the input before the agent sees it; DriftGuard watches what the agent does after.
All four guards. One gateway. Your keys.
CleverGuard on every call. ScopeGuard on governed agents. ClaimGuard on responses. DriftGuard on behavioral baselines. Free tier covers all four. Currently in private beta — request access.