Compliance Perimeter Drift

Compliance Perimeter Drift is the gap that opens when an agency's standardized automation stack stops matching the regulatory or data-residency perimeter of a specific client. The framework says the perimeter, not the tool, is the unit of standardization: agencies should map each client's compliance boundary first, then decide which pipeline stages can stay on shared infrastructure and which must run inside a client-controlled environment. The drift is invisible until an audit, a breach, or a procurement review exposes it. For agencies, the cost is not the tooling swap itself but the re-certification, re-documentation, and re-testing that follows a late discovery. A concrete signal: researchers used Claude Opus 4.8 and 5 to breach OpenAI's GitHub repository in under 72 hours, which shows how quickly code-adjacent systems become an attack surface when access boundaries are assumed rather than enforced. Agencies running shared CI runners across clients should treat that assumption as a perimeter risk, not a convenience.