Drift Alerts
Drift is the gap between what an agent's governance evidence declares and what its traces show. For example, an agent declared as not handling payment data whose traces contain card numbers. Drift Alerts list these gaps so you can investigate and close them.
Enterprise feature. Open the project-wide list with View Drift Alerts on the Risk Dashboard, or from Framework Coverage. An agent's open alerts also appear on its governance profile, on its Risk tab in AI Agent Center, and in its Risk Dashboard detail panel.
How drift is calculated
ANTS compares an agent's declared evidence from Evidence Collection with what its traces show over the last 7 days. Only agents with governance evidence are evaluated. Drift works from the agent's traces whatever their source: the ANTS Platform SDKs, OpenTelemetry, Budget AI or Portkey logs. Metrics that depend on detections show Not monitored until AI Guardrails has scanned the agent's traces.
| Metric | Declared value | Observed value | Drift when | Drift type | Severity |
|---|---|---|---|---|---|
| PII Detection | PII categories in data governance evidence | Share of scanned traces with PII | PII is declared and the rate is above 5%, or PII is not declared and any is found | Data | Medium |
| PCI Processing | "PCI data collected" in data governance evidence | Traces with PCI data | PCI data is found but declared as not collected | Data | Medium |
| Output Filtering | "Output filtering applied" in security evidence | Share of traces with PII or ethics and bias detections | Declared and the rate is above 5%, or not declared and any are found | Control | Low |
| Abuse Monitoring | "Abuse monitoring enabled" in security evidence | Share of traces flagged for ethics and bias | Declared and the rate is above 5%, or not declared and any are found | Control | Low |
| Safety Detection | Prompt injection protection or jailbreak prevention in security evidence | Share of scanned traces flagged for jailbreak or prompt injection | The rate is above 2% | Control | Low |
| Bias Monitoring | Protected attributes evaluated, or a bias assessment, in bias and fairness evidence | Traces flagged for ethics and bias | Bias monitoring is declared and any trace is flagged | Control | Low |
| Error Rate | A fixed target below 5% | Share of observations at ERROR level | The rate is above 5% | Performance/Safety | Low |
When drift is recalculated
A background job recalculates drift for every agent with governance evidence on a schedule, whether or not anyone opens the agent. Detection is continuous: an agent that nobody looks at is still re-evaluated. The pages that show drift, such as the agent's governance profile, its Risk tab in AI Agent Center, its detail panel in the Risk Dashboard and the project-wide Drift Alerts list, only read the stored alerts.
Drift is measured against what the agent's governance evidence declares. It is not statistical drift in quality scores.
Each calculation keeps one open alert per metric per agent:
- A drifting metric with no open alert creates a new alert.
- A drifting metric that already has an open alert updates it with the latest declared and observed values and detection time.
- A metric that is back within its threshold resolves its open alert automatically.
Drift types
Five drift types are defined: Control, Scope, Data, Risk and Performance/Safety. The automatic checks above raise Control, Data and Performance/Safety alerts. Scope and Risk are available as filter values, but no automatic check raises them today. Planned capabilities are listed on the roadmap.
What an alert records
- Type, severity and the metric that drifted
- Declared and observed values
- Detected time, and status (Active or Resolved)
- The affected evidence category, where one applies: data governance, security and abuse prevention, bias and fairness, or performance
- When resolved: who resolved it, when, and the resolution notes
- When sent to an integration: when, and to which channel
Working the queue
The Drift Alerts page shows summary cards for Active Alerts, Agents Affected, Critical / High and Resolved. Filter the list by status (All, Active or Resolved; Active is the default), agent, severity and drift type. Alerts are listed newest first.
From an alert's menu you can View Traces, View Profile, or Resolve it with resolution notes. Resolving requires write access to agent governance.
Automatic notifications
Each new drift alert is sent automatically, with no one needing to click, to the integrations connected for the project:
- Slack and Jira: a message to the channel or project mapped to the agent. See Slack and Jira.
- ServiceNow and PagerDuty: an incident, when the integration is connected with incident creation turned on. See ServiceNow and PagerDuty.
Notifications are de-duplicated. An alert is sent once, when it is created. Later recalculations that update an alert that is already open do not send it again. If a metric returns within its threshold, its alert resolves; if the metric drifts again later, a new alert is created and sent.
The message or incident includes the agent, drift type, severity, description, and the declared and observed values. The alert records when and where it was sent.
Send an alert manually
You can also send an alert yourself, for example to send it again. The Integrations column shows an icon for each connected integration. Select one to open Send Drift Alert Notification, choose ServiceNow, PagerDuty or both, and send. The alert then records when and where it was sent.
Closing drift by updating the declared evidence is legitimate when the baseline was wrong, but it changes what counts as compliant for that agent. Make it a reviewed decision and re-approve the evidence in Requests & Review.
Next steps
- Evidence Collection: the declared values that drift is measured against.
- AI Guardrails: the detections that supply observed values.
- Audit & Export: generate the compliance report for your agents.