Drift Detection
After an agent is governed, Clevername tracks changes to its configuration. If the agent's model, system prompt, expertise, or environment changes, the governance is invalidated and the agent must be re-reviewed.
What is drift detection?
Drift detection ensures that the agent running in production is the same agent that was governed. At submission time, Clevername computes a version hashfrom the agent's key configuration fields. When someone tries to deploy the agent, the hash is recalculated and compared. If they don't match, deployment is blocked.
What's included in the version hash
The version hash (SHA-256, first 16 characters) is computed from:
- Model — The LLM model the agent uses (e.g., claude-sonnet-4-6)
- System prompt — The full system prompt text
- Expertise — The agent's expertise tags (sorted alphabetically)
- Environment — non_prod, prod, or both
- Integration bindings fingerprint — Hash of governed MCP server and skill bindings
What triggers resubmission
Any change to the fields above invalidates the governance. Common examples:
- Changing the agent's model from Sonnet to Opus
- Editing the system prompt (even a single character)
- Adding or removing expertise tags
- Switching from non-prod to prod environment
- Modifying the agent's MCP server or skill bindings
Agent is modified
An org admin or agent owner edits the agent's configuration — for example, changing the model or updating the system prompt.
Deployment is attempted
When someone tries to transition the agent from draft to active (or redeploy it), the system calls check_agent_council_gate().
Hash mismatch detected
The current version hash doesn't match the hash stored at governance time. The system sets the agent's review status to resubmit_required and blocks deployment.
Agent owner resubmits
The agent owner must submit a new agent review. The previous submission is automatically withdrawn, and a new questionnaire must be completed (answers from the previous submission can be pre-populated for convenience).
Re-review
The agent reviews the updated submission through the normal governance process. Once governed, a new guardrail profile is compiled and the agent can be deployed.
Runtime Drift Detection
In addition to configuration drift, CleverGuard detects runtime drift— when an agent tries to use tools or models that weren't part of its governed profile:
| Drift Type | Detection | Response |
|---|---|---|
| Tool drift | Agent calls a tool not in scope | Blocked with error -32403. DLP event logged. |
| Model drift | Agent requests a non-governed model | Blocked with HTTP 403. Logged as a security event. |
| High-risk action | Action matches A4 patterns | Paused. SignedApproval push sent. Agent waits for approval. |