How drift accumulates, one reasonable change at a time
Configuration drift is the gradual divergence between a system's documented, intended configuration and what's actually running, built up from direct changes applied straight to a live system — often made under time pressure during an incident, and rarely reconciled back into the official definition once the pressure has passed. No single change usually looks unreasonable in isolation; the accumulated gap is what becomes a problem.
This matters for authorization specifically because reviewing a system's security posture typically means reviewing its documented, intended configuration — and that review provides limited real assurance once the actual running system has quietly diverged from what's on paper.
Replacing rather than patching removes the opportunity
Immutable infrastructure sidesteps this by never modifying a running instance directly: a change means building a new instance from an updated definition and swapping it in, with the old instance discarded rather than patched. Every instance running at any given moment traces back to a specific, versioned definition, rather than an accumulated and partially undocumented history of individual edits — which removes the specific opportunity for drift to open in the first place, rather than trying to detect and reconcile it after the fact.