Per-agent drift analysis: declared capabilities vs. observed audit activity. High-drift agents require operator review.