Formula
ADRIFT = (agent-authored PRs with
CDA deviations and
no linked CHI
÷ total agent-authored PRs)
× 100Thresholds
Governed agents
Target statePartial governance gap
MCP context reviewAI governance incident
MCP deployment requiredReading it
ADRIFT is the direct measurement of AI coding tools introducing ungoverned architectural drift. No other tool produces this number — ADRIFT requires both agent PR attribution AND a CDA Lens evaluation pipeline to exist simultaneously. It is not inferred from aggregate drift statistics. It is computed per-PR, per-agent, per-violation.
ADRIFT isolates the agent contribution to drift separately from human UDR. In an org where 40% of PRs are agent-authored, UDR alone cannot tell you whether the governance gap is a human process problem or an AI tooling problem. ADRIFT makes that attribution precise. A high UDR with a low ADRIFT means the governance problem is a human workflow issue. A high ADRIFT means the agents are ungoverned.
As orgs adopt AI coding tools at scale, ADRIFT becomes the leading indicator of architectural risk accumulation. An ADRIFT of 25% means 1 in 4 agent PRs is introducing ungoverned structural change. At 50 agent PRs per week, that is 12–13 unreviewed architectural decisions per week compounding silently — each one potentially contradicting a Lens rule, a Pillar constraint, or an approved design direction that the agent had no visibility into.
How rkito produces it
Every PR is evaluated for agent authorship and architectural conformance. The two signals are combined: a PR must be agent-authored, have CDA Lens violations, and have no approved Change Intention linked to the branch. ADRIFT is the percentage of agent PRs that satisfy all three conditions over a rolling 30-day window.
- 01
PR opened on branch
CDA pipeline is triggered on diff analysis
- 02
CDA identifies agent authorship
Commit signatures (Co-Authored-By: Claude Code, Copilot metadata, Devin session ID) + MCP server access logs
- 03
CDA runs full Lens evaluation on the diff
Every registered Lens is evaluated against the agent-authored changes
- 04ADRIFT++
Agent-authored + violations + no approved CHI
ADRIFT increments — ungoverned agent drift confirmed
- 05GOVERNED DRIFT
Agent-authored + violations + approved CHI exists
Governed drift — not counted in ADRIFT
- 06CONFORMANT
Agent-authored + no violations
Conformant agent PR — best case, not counted in ADRIFT
- 07
ADRIFT computed over rolling 30-day window
% of agent PRs in scenario 04 → org dashboard
Who reads it
ADRIFT is the metric that makes AI adoption risk visible. A CTO approving AI coding tools without ADRIFT measurement is flying blind on what those tools are doing to the architecture. ADRIFT converts AI tooling investment from a governance unknown into a governed, measured engineering capability.
ADRIFT broken down by Pillar shows specifically which architectural security rules are being violated by agent-generated code — not code-level vulnerabilities, but structural security design violations. An agent generating code without security Lens context is the structural risk, not the code it writes.
ADRIFT is the 6-month early warning. Agent-introduced ungoverned structural changes are the category most likely to produce systemic operational failures. They compound weekly, bypass operational review, and surface as incidents that cannot be explained by the approval history.
How it misleads
What to do at each threshold
Step-by-step response playbook for each signal state.
Agents are operating within governed bounds. Confirm the signal is real, not a detection gap.
- Verify agent attribution is working — check that MCP access logs are being correctly correlated with commits. A near-zero ADRIFT with low agent adoption is expected; near-zero with high agent adoption indicates either very good MCP integration or under-detection.
- Confirm commit signature coverage is comprehensive. If only one agent tool's signatures are configured, other agents may be authoring PRs that escape ADRIFT detection entirely and are counted in UDR instead.
Some agent PRs are missing design context. Find the pattern before it compounds.
- Navigate to
/changecontrols/designaudits, filter by agent-authored PRs and FAIL status. Identify which Lenses are failing on agent PRs versus human PRs. - If agent PRs fail different Lenses than human PRs, the agents lack specific design context. Identify the missing MCP context load — which Lens criteria are not being pre-loaded into the agent session before code generation starts.
Treat as an AI governance incident. Quantify the exposure before acting.
- Quantify first: agent PRs per week × ADRIFT rate = ungoverned structural changes per week entering the codebase. Present this number to engineering leadership as the cost of un-integrated AI tooling — not an argument to stop using agents, but a precise case for MCP deployment.
- The remediation is rkito MCP module deployment — not slowing down AI adoption. Deploy MCP integration to the agent toolchain, pre-load Lens criteria and Pillar constraints into agent sessions, and require CHI linkage before agent branches are opened. ADRIFT will follow.