Configuration drift

Systems wander away from how they were supposed to be configured, through manual fixes, emergencies and things nobody wrote down.

Six months later the running state and the documented state have little to do with each other, and the security assumptions were based on the documented one. Drift is not a failure of discipline so much as an inevitable consequence of operating things, which is why detecting it matters more than forbidding it.