A CRM agent that usually reads one assigned record requested 800 records late at night.
Observability, Audit & Assurance
See the action. Understand the evidence.
Connect identities, configurations, decisions and outcomes into an investigation path. Know what changed, why an action was allowed and which evidence supports the result.
See it in practice Explore capabilitiesInvestigate the unusual export
A CRM reader requests an unusually large late-night batch outside its task scope.
Slack#security-review
ChannelIs that our approved month-end export?
The batch is outside the assigned task.
Export investigationScope review
- Requested
- Large CRM batch
- Task scope
- Exceeded
- Effect
- No governed export dispatched
Compare the request with the month-end job and contact the owner.
Investigation opened with the exact request and policy evidence. A legitimate bulk job can use its separately reviewed path.
Request rejected. No action was dispatched. A new request needs its own review.
Ready
WHY IT MATTERS
“The agent did it” is not an explanation.
When an agent fails, the useful question is rarely just “what did the model say?” You need to know which configuration it used, which resource account it reached, what policy decided, whether approval changed and what the external system actually did.
DriftGate connects that context into an investigation path. Follow a request through policy, review, attempt, workflow and receipt. Inspect a configuration change alongside the consumers and actions affected by it. Keep operational visibility tied to evidence rather than inferring success from missing errors.
HOW IT WORKS
One investigation. Connected context.
Start with an agent, project, connection, release or operation. Follow the relevant identities and timestamps into the decision and effect records. Distinguish an unreachable endpoint from expired credentials, a permission denial from a tool failure, and an unknown external result from a confirmed no-effect outcome.
This makes investigation useful to developers, operators and reviewers without requiring every audience to see raw customer payloads or private conversations. Apply access and retention to evidence itself, and preserve the distinction between observation and the control that can actually prevent an effect.
Observe
Collect the selected events and their scope.
Correlate
Link requests, policies, approvals, attempts and receipts.
Investigate
Inspect exact identities, revisions and observation times.
Respond
Propose a scoped, authorized repair or containment action.
WHAT YOU CAN CONTROL
Observability, Audit & Assurance
O01Tracing and telemetry
Correlate requests, decisions, approvals, attempts, workflows and receipts with scoped telemetry.
See related workflowsO02Audit logs
Inspect governed changes and actions through tenant-scoped history and declared retention.
See related workflowsO03Evidence capture
Connect outcomes to source, release, permission basis and exercised enforcement boundaries.
See related workflowsO04Risk detection
Surface suspicious or unexpected patterns for review without turning risk scores into authority.
See related workflowsO05Forensics
Reconstruct source-to-decision-to-effect lineage while preserving original evidence and privacy.
See related workflowsO06Replay and simulation
Inspect compatible history and simulate policy without repeating live external effects.
See related workflowsO07Verification
Read back actual state. A written configuration alone is not proof of synchronization.
See related workflowsO08Metrics and reporting
Measure setup, adoption, drift resolution, action outcomes and approval burden.
See related workflowsO09Incident response
Link investigation, scoped suspension and evidence-led recovery to appropriate authority.
See related workflowsO10Runtime health
Distinguish reachability, expiry, callable state, client freshness and observed runtime identity.
See related workflowsIN PRACTICE · EXAMPLE WORKFLOW
Don’t stop at “the agent did it.”
A business record changes in a multi-agent workflow. An investigator needs to know why it changed and under whose authority.
Correlate the requester, authorizer, workload, project/profile, resource, policy, approval, attempt and receipt. Retain scoped access to redacted evidence and exact source versions.
See the workflowTHE INTENDED RESULT
Follow the action from intent to recorded outcome without rebuilding a timeline across unrelated logs. Identify gaps explicitly.
THE OPERATIONAL RESULT
Enough evidence to act. No unnecessary exposure.
Keep credentials out of logs and receipts. Capture only the information needed to explain the operation. Compare independently authorized connections and actual revisions to find a specific correction instead of resetting every client or collecting all private conversation content.
MORE WAYS TO USE IT
Find your next workflow.
SALES OPERATIONS
An unusual export should lead to a useful investigation.
An agent that normally reads a few CRM records starts requesting large batches at an unexpected time.
Audit & investigations
CLOUD OPERATIONS
A green dashboard is only as useful as its evidence.
A target stops reporting during a rollout. Its last known status was healthy.
Audit & investigations
SOFTWARE
Stop an unproductive loop from consuming the entire run budget.
An agent repeatedly calls a failing tool or produces costly responses without making progress.
Audit & investigations
YOUR QUESTIONS
A little more detail.
Is a heartbeat proof that an agent is governed?
No. Reachability, policy freshness, loaded configuration and an accepted governed action are different observations. A stale target should show stale visibility, not an unsupported protection claim.
Can I investigate without exposing entire conversations?
The evidence model uses scoped metadata and deliberate, redacted content capture. Access and retention apply to evidence as well as to business data.
Does an alert mean an action was prevented?
Only a pre-effect enforcement result establishes that a protected action was blocked. A trace or post-action alert supports investigation and response, not retroactive prevention.
BUILD WITH INTENTION