D-305 Team
Drift
A developer owns their laptop and the sandbox runtime on it. Team cannot stop them from changing it. It can notice, and say so. Drift is a machine whose sandboxes do not match what the team published.
What counts as drift
| Drift | How it is noticed | Common cause |
|---|---|---|
| A sandbox runs a policy that does not match the published revision | The policy the sandbox actually holds is compared with the published revision for that agent. | A rule loaded onto the sandbox by hand, outside Boundlane. |
| An approval with no matching review | The runtime records every approval. Each one is matched to a decision made in the console. | A request approved in the terminal on the machine. |
A machine that is behind the current revision is not drift either. The machine list shows the revision each machine holds and when it last checked in; it catches up the next time it runs a command that reads the policy.
A sandbox still running on an earlier revision after a wall change is not drift. It keeps the paths it started with by design, and the console shows it as waiting for its next run.
Where it shows
The machine list flags each drifting machine with the kind of drift, the sandbox, and when it was first seen. A console approval matched to the runtime's record is shown with both: who decided, and when the sandbox loaded it.
What to do about it
- A local approval. Read what was approved in the decision log. If it was right, add the host to the team policy so the next one goes through the console. If not, talk to the developer.
- A policy mismatch. Ask the developer to stop that sandbox and start the agent again with
boundlane run, which starts it from the published revision.
What drift cannot do
Drift is a record, not a lock. A developer who stops the forwarder, signs out, or runs an agent outside Boundlane is not stopped by it. A sandbox Boundlane did not start sends no records at all. The console shows a machine that stopped checking in, not what it did afterwards.
If you need enforcement the machine's owner cannot change, run the gateway where developers do not administer it. That is the License plan.