governance-drift
Deterministic AI-agent governance drift detection — evidence-backed findings, stated coverage gaps, and SARIF output for CI.
Your organization has an approved baseline of AI agents (which agents, which models, which
connectors) and a reality that drifts from it: vendors retire models that production agents
still pin; agents appear that nobody approved. governance-drift detects that drift and
reports it under rules that make the report trustworthy — every finding carries a source
URI, JSON field path, and content hash; findings that can't be re-verified are dropped; and
coverage gaps are stated rather than hidden.
This is the Python reference implementation. The same pipeline also runs as a Weft graph on WeaveMind Cloud (clonable, ~$0.03/run) with a human approval gate.
Install
pip install governance-drift # file-based scan (pyyaml only)
pip install "governance-drift[http]" # + live Foundry/tenant HTTP sources
Scan
govdrift scan \
--inventory approved.yaml \
--foundry foundry_models.json \
--tenant tenant_observed.json \
--out out/
Writes out/<date>-drift.md (human report), out/findings.sarif (SARIF 2.1.0), and
out/hashes.json (cross-run source-change tracking). Exit code is 1 if any finding
survived verification, else 0 — so it doubles as a CI gate.
Governance drift as a GitHub code-scanning check
govdrift emits SARIF, which GitHub ingests natively. Drop this in a workflow to turn
unapproved-agent and retired-model findings into code-scanning alerts:
- run: govdrift scan --inventory approved.yaml --foundry foundry.json --out out/
continue-on-error: true # let SARIF upload run even when drift is found
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: out/findings.sarif
What it checks
- Model retirement — a vendor-retiring/deprecated model that an approved agent still pins. Severity scales with days remaining (≤30 critical, ≤90 high, ≤180 medium).
- Unapproved agents — anything observed in the tenant that isn't in the approved baseline. HIGH by definition.
Every finding's evidence is re-resolved against the payload it came from before the report
is written; a finding citing an unresolvable path is dropped and counted. Adapters are
small classes implementing ChangeSource / InventorySource — Azure AI Foundry model
lifecycle and inventory/tenant JSON-YAML ship today; add your own in ~40 lines.
License
MIT © Jeremy Gracey
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file governance_drift-0.1.0.tar.gz.
File metadata
- Download URL: governance_drift-0.1.0.tar.gz
- Upload date:
- Size: 34.6 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
9e70d0f6b77dce0cdb24609430e5585e544a11685b13f4d6f86701abd0e2f72e
|
|
| MD5 |
71e5989adeb26b2d806ba2f839ddb428
|
|
| BLAKE2b-256 |
b065b09b45594d74d75bec0fb0324b84bc6c29fafe8e20ce2ab64016a83e7951
|
Provenance
The following attestation bundles were made for governance_drift-0.1.0.tar.gz:
Publisher:
python.yml on JeremyGracey-AI/governance-drift-researcher
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
governance_drift-0.1.0.tar.gz -
Subject digest:
9e70d0f6b77dce0cdb24609430e5585e544a11685b13f4d6f86701abd0e2f72e - Sigstore transparency entry: 2507520163
- Sigstore integration time:
-
Permalink:
JeremyGracey-AI/governance-drift-researcher@d9a6878de6e6ee5fa20b3c074e5328e778d29b0c -
Branch / Tag:
refs/tags/v0.1.0 - Owner: https://github.com/JeremyGracey-AI
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python.yml@d9a6878de6e6ee5fa20b3c074e5328e778d29b0c -
Trigger Event:
push
-
Statement type:
File details
Details for the file governance_drift-0.1.0-py3-none-any.whl.
File metadata
- Download URL: governance_drift-0.1.0-py3-none-any.whl
- Upload date:
- Size: 24.2 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
a3029b12ad4b3a82e2fb09d54881656338f25e0168859d9e48e1f3703a521afd
|
|
| MD5 |
830652f6de6f778582a686b4c861edbc
|
|
| BLAKE2b-256 |
a46976f7b585127a4a051126c9f26e63b8e11a2c938fa591ce7cb4687d5e72ee
|
Provenance
The following attestation bundles were made for governance_drift-0.1.0-py3-none-any.whl:
Publisher:
python.yml on JeremyGracey-AI/governance-drift-researcher
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
governance_drift-0.1.0-py3-none-any.whl -
Subject digest:
a3029b12ad4b3a82e2fb09d54881656338f25e0168859d9e48e1f3703a521afd - Sigstore transparency entry: 2507520241
- Sigstore integration time:
-
Permalink:
JeremyGracey-AI/governance-drift-researcher@d9a6878de6e6ee5fa20b3c074e5328e778d29b0c -
Branch / Tag:
refs/tags/v0.1.0 - Owner: https://github.com/JeremyGracey-AI
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python.yml@d9a6878de6e6ee5fa20b3c074e5328e778d29b0c -
Trigger Event:
push
-
Statement type:
