Respond to a Drift Finding

Goal: triage any drift finding with a decision, not a shrug. Every finding is one of three stories: reality moved, the design moved, or the divergence is fine. The playbook per kind:

Finding	It Usually Means	First Move
Design Changed	Someone edited or re-ran an approved design	Decide which is right: revise properly if the change should stand, restore if not
Control Regressed	A rule that passed at approval now fails	Treat like a failing test: fix design or environment, or route through sign-off via revision
Not Found in Environment	An approved component is not observed running	Deploy lag, decommission, or discovery blind spot; check which before acting
Unsanctioned Technology	Something runs that no design or catalog accounts for	Investigate; then either catalog it, design it in, or remove it
Built Out of Sequence	Later phases started before earlier ones finished	A delivery conversation, not a design one; the plan encodes the dependency for a reason
Security Tasks Skipped	Build marked done, hardening tasks open	Do not let this one age; it is the finding audits ask about
Done but Not Observed	Tracker says done, environment disagrees	Someone closed a ticket early, or deploy failed silently
Vendor Contract at Risk	A leveraged agreement renews soon or lapsed	Renew, or plan the migration; the contract record clears it

The Two Buttons

• Acknowledge when the divergence is understood and accepted: it stays visible, stops counting, never blocks the gate, and is recorded as your call.
• Resolve when you have fixed the condition outside the platform's view; if you are wrong, the next check reopens it.

Zero Open Is the Rhythm

Findings dedupe and auto-resolve when their condition clears, so a healthy package sits at zero open. Anything sitting open for a week is either work or an acknowledgment waiting to be made. (Drift in full)