How to detect AI agent scope drift before it becomes review work

What scope drift actually is

Scope drift happens when an agent's planned actions exceed the boundary of the requested task. The request was specific. The plan is broad. Sometimes the broadening is helpful. Often it is not, and either way it expands what a human now has to review, verify, and accept or reject.

The key insight is that drift is visible before the run executes. An agent that is about to touch fourteen files when the task named two has already revealed the drift in its plan. The opportunity is to compare the plan against the request at that moment, not after the changes land.

Comparing planned actions against the request

The first signal is a direct comparison: what did the task ask for, and what does the agent plan to touch? When the planned file set, the planned actions, or the planned commands extend well beyond the declared task, that delta is the drift.

This comparison is most useful when it is structural rather than impressionistic. A declared write boundary at task start gives you something concrete to compare against. Without a declared boundary, drift is only visible in hindsight, during review, which is the most expensive place to find it.

Watching for sensitive changes

Not all drift is equal. Touching an extra test file is low risk. Touching authentication code, configuration, migrations, or dependency manifests is high risk even if it is a single file. Drift detection should weight sensitive areas more heavily than file count alone.

A useful drift signal combines two things: how far the plan extends beyond the request, and whether any of the extension touches sensitive surfaces. A small drift into a sensitive area can matter more than a large drift across cosmetic files.

Repeated drift is a pattern, not an accident

One drift event is noise. The same drift appearing across many sessions is a pattern worth fixing. If an agent repeatedly expands the same kind of task into the same kind of refactor, the underlying cause is usually a missing constraint or a stale instruction, not a one-off.

Tracking repeated drift patterns turns a stream of individual events into something actionable: a place where the task contract, the instructions, or the scope policy needs to change so the drift stops recurring.

• Planned file set compared against the declared task scope
• Sensitive surfaces weighted above raw file count
• Repeated drift patterns surfaced, not just single events
• Drift discovered only during human review
• Every drift turned into an approval prompt

Blocked, narrowed, or escalated

Detecting drift is only half the job. The response matters more. There are three useful responses, and most drift should resolve with the first two:

1. Narrowed. The plan is brought back to the declared scope automatically, and the run continues on the intended work.
2. Blocked. A planned action that is clearly outside scope and clearly unsafe is stopped before it runs.
3. Escalated. When the drift represents a real decision (a genuine choice about whether to expand the work) it goes to a human with context, not as a vague prompt.

The goal is that escalation is rare and meaningful. Most drift should be narrowed silently, so the human only sees the cases that actually require their authority.

How Avorelo helps

Avorelo declares the write boundary at task start and compares the agent's planned actions against it before the run continues. Drift that falls within safe bounds is narrowed back to scope automatically. Drift into sensitive surfaces is blocked or escalated with context. Repeated drift patterns are surfaced so the underlying cause can be fixed.

The result is that scope drift is caught before it becomes review work, and the approvals that remain are the ones that genuinely need a human decision.