My drift detector is built on one idea: take two snapshots of your cloud, diff them, and grade what moved. A security group opened to 0.0.0.0/0 ? Critical. An RDS instance that flipped to public? Critical. A tag someone fat-fingered? Low. Every rule is a function of an old → new transition — a change happened, and I score how bad the change is. Then I went to add "your Secrets Manager secret hasn't rotated in too long" and the whole model fell over. Not because it's hard to detect. Be...