Everything worked.
That was the problem.
Four production systems. Four mandate drift failures. In every case, monitoring was active, compliance was maintained, dashboards were green. In no case did any existing control layer detect that execution had become illegitimate.
$440M in 45 minutes.
Everything worked.
On August 1, 2012, Knight Capital deployed new software that inadvertently reactivated a deprecated trading algorithm. The system executed millions of trades in 45 minutes, accumulating $440M in losses before it was manually shut down.
The system was never broken. It was executing correctly — under an authorization that had expired. The deprecated flag held old instructions that were never re-validated against current conditions. No control layer asked whether the mandate was still valid.
Monitoring saw activity. Compliance saw rules followed. Governance saw nothing — because no governance layer existed for mandate continuity.
The model didn't break.
The assumptions died.
Zillow's automated property acquisition system continued optimizing for growth while the valuation model's underlying assumptions — stable markets, predictable appreciation, reliable comparable data — had silently degraded.
The system remained operational and technically correct. The mandate — acquire at scale because valuation is reliable — was no longer valid. No control layer detected this divergence. The $500M write-down came after the drift.
Decision Integrity operates before it.
No code break.
No alarm. Authority drifted silently.
The COMPAS recidivism risk scoring system's operational scope expanded beyond its original authorization boundaries without any re-legitimation event. Every output remained technically correct under the original rules.
Authority drifted into territory it was never explicitly authorized for. Because no DIP-level scope gate existed, the system continued executing actions beyond the boundaries of its original mandate — correctly, without error, without alarm.
Effective accountability requires non-narrative proof — a witness chain that shows what the system was authorized to do and what it did.
DIP Audit #1.
Rule compliance = 1. Mandate integrity = 0.
In early 2024, Klarna deployed an AI customer support system handling 700 customer service agents' worth of queries. By May 2024, it was handling the majority of customer service interactions. In September 2025, Klarna reversed course: the AI was not apparent.
The system operated within defined rules throughout. What the Evidence shows: the quality commitments made at deployment — the conditions that authorized operation at scale — changed without re-validation. The original mandate had effectively expired 15 months before the reversal.
Rule compliance is not mandate integrity. A system can pass every compliance check and still be operating under an expired authorization.
Assess decision legitimacy in your system.
DriftBench runs a sealed evaluation: policy binding, witness tuples, scope gates, fail-closed behavior. Against your model endpoint. No data leaves your environment.