Drift

Conditions change continuously. Markets reprice, regulations move, the population an institution serves turns over, the technical ground underneath a practice changes. An institution oriented to reality tracks that change and adjusts against it. An institution that stops tracking continues on its last good heading, and the distance between where it believes it is and where it actually is widens unnoticed.

Drift is the widening discrepancy between what an institution understands and the conditions it actually faces. It accumulates whenever the institution stops tracking the change and continues on its last good reading. The first symptom is a position kept too long: the institution keeps its heading while the reference that heading was set against goes on changing. Beneath the symptom is the discrepancy, growing. The institution registers no alarm, because internally everything agrees. The agreement is the problem.

A healthy institution exhibits both. Its people concur, its procedures align, its records reconcile, and all of that internal coherence tracks something real outside the walls. The two travel together, so no one separates them.

A drifting institution exhibits the first while losing the second, and it can grow more coherent as it does. Most people expect failure to announce itself through disagreement and disorder. A drifting institution behaves the other way: everyone still agrees, procedure is still followed, the forms are signed, the vocabulary is shared, the conclusions reconcile. Each of these is genuine. The institution is generating real evidence of its own health, and every piece of that evidence is internal. The reference point that would test it is external, and contact with that reference has weakened.

Institutions conflate the two continuously. Unanimous sign-off reads as confirmation that a decision is correct. It confirms that the people signing concur. Whether their shared conclusion still corresponds to the conditions outside is a separate question, and it is the question drift erases.

Drift is present at all times, because the conditions an institution navigates against never sit still. The only defense is continuous attention to the external reference. Take that attention away and the institution does not stop drifting. It travels with whatever forces are acting on it, away from correspondence, while its instruments read steady.

The precipitating events look ordinary the entire way down. An exception gets handled. A standard gets interpreted generously. A measurement comes in slightly off and gets processed. Each step reads as competence. The threshold that turns accumulated drift into failure arrives through the gradual removal of the things that were absorbing it, and the crossing leaves no mark at the time it occurs.

Drift in a single reference does not stay local. Downstream functions measure their own position against the drifted one, treat it as correct, and adjust toward it. The error compounds as it spreads, and because each step is a reasonable adjustment to a trusted input, no individual step looks wrong.

Formation flight shows the mechanism plainly. The lead aircraft is responsible for tracking the world outside, navigating and watching for other traffic, while each wingman holds position against the lead. That division is the design, and it works as long as the lead keeps contact with the external reference. Let the lead drift, and every wingman follows it precisely, holding perfect position against a ship that is no longer where the outside world would put it. The same failure occurs when a wingman mistakes a drifting neighbor for the lead. In both cases the formation does exactly what formation requires, and the error travels through the whole flight before anyone has named it.

A drifting institution produces failures that look like discrete incidents, each with its own investigation and its own correction. When the same failure returns on a schedule, the schedule is the diagnostic. The rhythm has a cause: a correction resets the institution to a baseline, the external reference keeps changing at a roughly constant rate, and so the time it takes to drift back into failure stays about the same. A stable interval between recurrences can be evidence that the force producing them is still active and that corrections have addressed its expressions instead of its rate. A lengthening interval can indicate that something upstream is being reached. The disappearance of recurrence is weaker evidence, because exposure, conditions, activity, and chance can also remove the return.

Most institutional correction targets the event. The investigation explains what happened, the procedure changes, the records show a response. The force that produced the drift continues acting, and the interval expires again on its own clock.

Verification works by carrying the external reference into the institution and reading the records against it. That is what makes it a defense against drift, and it is also what drift erodes first, because contact with the reference is the very thing drift wears away. The checks keep running. Their question quietly shrinks. What began as a test of whether the records are accurate settles into a test of whether the records agree with each other, and a drifting institution passes that test more easily the further it drifts, because internal coherence is the one thing drift improves.

In the documented cases, the clean audit in the period before a failure broke into view was not a contradiction. It was drift working as drift works.

Rasmussen, Vaughan, Snook & Dekker · The ordinary way down

Drift is the most heavily studied neighborhood this corpus borders, and the account above of how it accumulates is inherited. Jens Rasmussen described work migrating toward the boundaries of acceptable performance under ordinary pressures of cost and effort. Diane Vaughan showed deviance normalizing through a sequence of acceptable-seeming steps. Scott Snook named practical drift for the slow uncoupling of local practice from written procedure, and Sidney Dekker's Drift into Failure treats the whole phenomenon at book length: systems moving toward failure through small, locally sensible decisions made in pursuit of success under scarcity.

That failure can look ordinary the entire way down is their finding, and this page builds on it. This page inherits that account and confines its own use of drift to the correspondence axis: the divergence between a system's understanding and the external conditions it faces.

Metrology & David Mills · The inherited reference

The propagation mechanism has an older home still. Engineering formalized reference inheritance long ago: metrology's calibration hierarchies exist because error travels through chains of reference, and distributed clock synchronization supplies a close analogue to this page's formation case: an upstream source that appears to operate correctly while delivering the wrong value, tracked faithfully by everything downstream.

Engineering also built the defense, independent reference comparison, on the principle that a source cannot establish its own correctness from its followers' agreement. A chain can be perfectly stable and perfectly wrong, and that result belongs to engineering.

The institutional case changes the problem: the inherited reference may be a model or a judgment with no unit, no error budget, and no recalibration schedule, and a unit may not know it is downstream at all.

Daniel Pauly · The shifting baseline

The move from engineered references to human baselines has its own predecessor. Daniel Pauly's shifting baseline syndrome describes successive generations of fisheries scientists taking the already depleted state encountered at the beginning of their careers as the baseline against which later change is judged, a qualitative reference drifting across succession while every individual assessment is locally competent.

In this page's terms, that is reference inheritance in an epistemic register, and it precedes this corpus. What the corpus asks past these neighbors is more specific: how the mechanism operates through contemporaneous chains of institutional units, and what the timing of recurring failure can reveal about whether corrections reached the process producing it. The reliability literature on repairable systems supplies a mathematical cousin for that second question, repair that restores function without touching the underlying deterioration, and the laboratory expects to learn where these meet.