§ PLATFORM / PERMISSION DRIFT
Know when an AI agent's permissions change
Execlave records what each agent is allowed to do as a baseline, compares it with the current policies every hour, and flags every permission that was added, removed, never used or used for the first time. Each finding and each decision on it lands in the audit log.
§ WHAT IT DOES
A detective control for least privilege
Policies decide what an agent may do right now. Drift detection tells you when that changed, and whether the agent uses what it was given.
A detective control for least privilege
01 / Capability
Automatic baselines
Every agent governed by a permission-granting policy gets a baseline on the next hourly run, with a SHA-256 hash over the snapshot. Org-wide policies count as well as agent-specific ones.
02 / Capability
Hourly comparison
Each hour the current permissions are compared with the baseline. Every added or removed permission becomes an event with a severity, and an identical open event is never duplicated.
03 / Capability
Unused and first-time use
Tools granted but not called in 30 days are flagged as over-privilege. A tool call the agent has not made in 90 days is flagged as first-time access when the trace arrives.
04 / Capability
Decisions on the record
Admins acknowledge, dismiss or accept a change as the new baseline. Detection, every baseline change and every decision are written to the hash-chained audit log.
§ THE BASELINE
What a baseline records
Six permission sets, read from the active policies that govern the agent.
What a baseline records
§ FINDINGS
What gets flagged, and how severe it is
Severity is decided by the change itself, so a new delete tool never looks like a new read tool.
What gets flagged, and how severe it is
Permission added
When it is raised
A permission is in the current policies but not in the baseline.
Severity
Critical for delete, drop, truncate or remove tools and for sensitive PII types (SSN, financial, PHI, PCI, date of birth, trade secrets); high for a new tool, action or external domain; medium otherwise.
Permission removed
When it is raised
A permission is in the baseline but no longer in the policies.
Severity
Low
Unused permission
When it is raised
A tool in the baseline has not been called in the last 30 days.
Severity
Low
First-time access
When it is raised
A trace shows a tool call the agent has not made in the last 90 days.
Severity
Critical when the tool name points to personal, health or payment data; medium otherwise.
| Finding | When it is raised | Severity |
|---|---|---|
| Permission added | A permission is in the current policies but not in the baseline. | Critical for delete, drop, truncate or remove tools and for sensitive PII types (SSN, financial, PHI, PCI, date of birth, trade secrets); high for a new tool, action or external domain; medium otherwise. |
| Permission removed | A permission is in the baseline but no longer in the policies. | Low |
| Unused permission | A tool in the baseline has not been called in the last 30 days. | Low |
| First-time access | A trace shows a tool call the agent has not made in the last 90 days. | Critical when the tool name points to personal, health or payment data; medium otherwise. |
§ HOW IT WORKS
How permission drift detection works
From the first policy to a decision an auditor can read.
How permission drift detection works
Govern the agent with a policy
Give the agent an access control, PII access, data restriction, action approval or external call policy, scoped to it or to every agent.
Execlave captures the baseline
On the next hourly run the agent's current permissions become its baseline. Admins can also capture one on demand through the API.
Drift is checked every hour
The hourly run compares the policies with the baseline and checks for unused tools. First-time tool calls are checked as traces arrive.
Review the findings
Open findings are listed on the dashboard's drift page, filterable by severity, and by execlave drift list, which also filters by agent.
Decide, on the record
Acknowledge or dismiss a finding, or accept a change as the agent's new baseline. Accepting also settles the agent's other open changes against the old baseline.
§ FAQ
Permission drift, answered
Permission drift, answered
Does drift detection block anything?
No. It is a detective control: it tells you that permissions changed. Blocking happens in policy enforcement, before each governed action runs.
How do I know detection is actually running?
GET /api/v1/permission-drift/status reports whether the hourly run is scheduled, when it runs next and whether any run failed, so "no findings" and "not running" never look the same.
Do policies that apply to every agent count?
Yes. A policy with no agent list applies to every agent, the same rule enforcement uses, so its permissions are part of each agent's baseline.
What happens when I accept a change as the new baseline?
The agent's current permissions become its baseline, the old baseline is marked superseded, and the agent's other open added or removed findings are settled. All of it is audit-logged with who did it.
Does drift show up in compliance reports?
Yes. The signed compliance report has a permission posture section per agent: when and why the baseline was captured, how many tools and PII types it allows, and how many drift findings are open, how many of them critical.
Who can see and resolve findings?
Developers and above can see findings. Resolving them, capturing a baseline on demand and accepting a new baseline need the Admin role.
Start watching your agents' permissions
Connect an agent and give it a policy. Its baseline is captured on the next hourly run.