Practical Drift

Why it matters

Nobody breaks the rules — and the system fails anyway. Over time the way work is actually done slides away from the way it is officially written down, one small, locally sensible shortcut at a time: each deviation saves a minute, fits the real situation, or routes around a constraint the procedure-writers never foresaw, and none of them causes any harm on its own. The danger is that these drifts accumulate invisibly — each unit sees only its own reasonable adaptation — until one day the gaps between the drifted parts line up, and the failure that results is one no single shortcut could ever have produced alone.

For example: a hospital ward’s medication-handoff procedure says the outgoing nurse reads each drug aloud from the chart while the incoming nurse confirms it against the patient. It’s slow, so over a busy year it quietly compresses — outgoing nurses start handing over a written summary instead, incoming nurses skim it, the read-aloud check survives only for “the complicated patients.” Every shift it works fine; the ward is proud of how smoothly handoffs run. Then a patient is moved between two units whose summaries use slightly different shorthand for the same drug, the receiving nurse reads it the way her own unit means it, and a dose is doubled. No one was careless. Two locally rational drifts simply assumed each other’s old conventions, and the assumption stopped holding.

What it reveals. Whether the documented procedure still describes the real work — and where local adaptations have accumulated into a hidden gap between what the manual says and what people actually do.
How it changes the read. You stop asking “who broke the rule?” and start asking “why was this deviation locally rational, and which cross-unit assumption does it quietly depend on?”
When to foreground it. A system that has run “fine” for years without a serious failure; workarounds that no one flags as deviations anymore; an incident that exposes a gap between “what we do” and “what the manual says.”
What you’d miss without it. That the failure is structural and invisible — each unit’s drift is harmless alone, the danger lives only in the alignment of gaps no single vantage point can see, and blaming an individual leaves the system that invited the drift untouched.
Where it misleads. It can slide into hindsight (“they should have followed procedure”) when the deviation was the rational response to a real constraint; and reinstating the original rule without fixing the conditions that drove the drift just makes the same drift return.

How to invoke it in Ora

You want to see how a process actually runs — the real steps, hand-offs, and slow points — not the tidy version in the policy binder, and especially where the two have quietly come apart.

Describe the process and ask:

“Map how this onboarding workflow actually works step by step — the real steps and hand-offs, where it slows down, and where what we actually do has drifted from the documented procedure.”

This rides inside the Process Mapping analysis, which documents the real, current-state flow of a process — its steps, the actors who perform them, the dependencies, the bottlenecks, and the hand-offs between people. The practical-drift lens is one of the always-present points of view it brings to that work: it is the discipline that refuses to take the official procedure at face value, surfaces where local practice has deviated, and asks of each deviation whether it’s an improvement worth folding in or a latent risk waiting to align with someone else’s.

One thing to know: phrases like map this process, how does this workflow actually work, map the steps and hand-offs, as-is process, or current state are what route you here. Naming the lens alone — “apply practical drift” — doesn’t route; you describe the process you want mapped, and the lens loads with the analysis.

Give it the real process, not the policy text — the actual steps people take, who does what, where work waits or gets passed along, and any known pain points or workarounds. The lens is only as good as the gap it can see between documented and lived practice, and that gap is invisible if you feed it the manual.

One thing Ora won’t do: take the documented procedure as the truth. If actual practice wasn’t investigated, the map says so explicitly rather than quietly presenting the official version as if it were how the work is really done.

How it works

On 14 April 1994, in cloudless skies over the no-fly zone of northern Iraq, two U.S. Air Force F-15 fighters shot down two U.S. Army Black Hawk helicopters, killing all 26 people aboard. An AWACS surveillance plane — a flying radar station whose entire job is to track every aircraft in the area — was watching the whole time. There was no enemy, no equipment failure, no single gross blunder, no villain. By every measure of training and technology it was an impossibly well-equipped operation, and it killed its own people in clear daylight. For years the obvious questions — who screwed up, who do we punish — produced no satisfying answer, because the honest answer was: nobody, exactly.

The sociologist Scott Snook spent years reconstructing it, and what he found was not a chain of errors but a slow, quiet slide. Every unit involved had, over time, drifted from its written procedures in small, locally sensible ways. The helicopters used radio frequencies and identification routines that made perfect sense within their own operation but no longer matched what the fighters and the AWACS crew expected. Who was supposed to talk to whom, and on which channel, had settled into local habits that worked fine inside each unit and had never been tested across all of them at once. None of these adaptations was reckless. Each one saved time, fit the reality on the ground, or worked around a constraint the procedure-writers had never anticipated — and each one, on its own, was harmless. The catastrophe was that on this one day the gaps between the drifted units lined up, and the helicopters fell into a seam that no one could see from inside their own piece of the system. Snook named the pattern practical drift: the slow uncoupling of how work is actually done from how it is officially prescribed, driven not by rule-breaking but by local rationality — the plain fact that each small deviation is the sensible thing to do where you are standing.

That is what makes practical drift so dangerous and so hard to catch: it is structural, and it is invisible from the inside. Each unit sees only its own modest, reasonable adaptation and has every reason to feel good about it — the work is getting done, the shortcuts are paying off, nothing bad has happened. What no one can see is that the cross-unit assumptions that once held silently — they’ll be on this frequency, they’ll identify themselves that way, they’ll expect us to call first — have quietly stopped holding. The drifts don’t announce themselves. And the failure, when it finally comes, is one that no single unit’s drift could have produced alone; it requires the alignment, and alignment is exactly the thing no one is positioned to notice. The sociologist Diane Vaughan found the same pattern wearing a different name when she dissected NASA’s decision to launch the Challenger: she called it the normalization of deviance — the way a deviation, repeated again and again without disaster, gradually stops feeling like a deviation at all and becomes simply “how we do it,” until it is invisible even to the experts who live inside the system.

You do not need a war zone or a space agency to watch it happen. Consider a data center’s backup procedure: nightly full backups, with the off-site copies verified once a week. It is sound, and at first it is followed. Then the full backups start slowing down overnight processing, so the team switches to incremental-only — a reasonable call. The weekly verification check is tedious and always passes, so it slips to monthly, then quarterly, then “when someone remembers.” Nothing breaks. The system runs fine for two years, and the smooth running is itself the trap — it breeds the complacency that lets the drift continue unremarked. Then a ransomware attack encrypts the primary storage, and the team goes to restore from backup and discovers the truth all at once: the most recent clean backup is 11 days old, and the off-site replicas haven’t been verified in four months. No one was negligent on any given night. The procedure simply drifted, one locally sensible decision at a time, until the safety it was supposed to guarantee had quietly evaporated. The name for that slide — the one this lens is built to catch before the attack comes, not after — is practical drift.

Framework & implementation

This section uses Ora’s own terms for the parts of an analysis, so that if you open the actual mode and lens files they line up. Each is glossed in plain language on first use.

Pipeline execution

Practical drift is one of the always-loaded mental models in the Process Mapping analysis — it sits in the mode’s ANALYTICAL PERSPECTIVES block under “always loaded,” beside bottlenecks, leverage, feedback loops, Alexander’s pattern language, the Swiss cheese model, and scale. Process Mapping has no single required lens — its lens_dependencies.required list is empty — so its method is the descriptive documentation of a process’s real, current-state flow (steps, actors, dependencies, bottlenecks, hand-offs); practical drift informs that read rather than being the method. The mode runs at Gear 4, Ora’s most thorough setting — a Depth analyst and a Breadth analyst work the process in parallel, critique each other (cross-adversarial evaluation), and revise.

Honest host-fit note. The lens’s own file scopes it to post-mortem analysis, safety audit, and organizational risk — diagnosing accidents and latent hazards after the fact, or auditing where a system’s defenses have quietly eroded. Process Mapping is its public host, and the connection is genuinely apt: process-mapping documents how a process actually works, and practical drift is precisely the lens for the gap between the documented procedure and actual practice — the very thing a faithful process map is built to surface. So a reader meets it here as the lens for reading drift in a mapped process, while its richest native use is the safety post-mortem.

Where the lens engages. It activates on its Detection Signals — standard procedures that haven’t been audited against actual practice recently; an incident that reveals “what we do” and “what the manual says” have diverged; workarounds that are now so normal no one recognizes them as deviations; a system running “fine” for a long time without a serious failure (the complacency tell); local pressures of time and resource that routinely force informal adaptations. Its Application Steps are the discipline the map runs on: map the official procedure step by step; observe or interview to discover the actual practice and where it diverges; for each deviation, judge whether it’s an improvement or a latent risk; identify which deviations have been normalized (the most dangerous, because no one flags them); and either update the procedure to capture the better practice or enforce the original — but never leave the gap undocumented.

What it contributes to the analysis. The lens lands most directly in the mode’s Official vs actual divergence section, where it supplies each place the documented process differs from the lived one, with the deviation and any workaround named — and it is the reason the mode carries an explicit “official-vs-actual: not investigated in this pass” atom rather than silently defaulting to the policy version. It also sharpens the Sequential step breakdown (swim-lane) (mapping official against actual steps), the Handoff and friction points section (drifted hand-offs are exactly where cross-unit assumptions quietly stop holding), and the Bottleneck identification section (a normalized workaround is often the symptom of a constraint nobody redesigned). The connection: a process map that captures only the official procedure is a fiction, and practical drift is the discipline that maps the real process and registers each deviation’s disposition.

Cross-adversarial evaluation. At Gear 4 each analyst’s reading is critiqued by the other, which catches the mode’s signature failures, keyed to its Critical Questions: CQ2 presses whether the analysis has distinguished the documented (official) process from the actual (lived) one or described only one as if it were both (the failure mode is official-vs-actual-elision), and CQ5 presses whether hand-offs between actors were examined for friction and information loss or treated as frictionless (handoff-blindness) — the two checks where drift hides. The evaluator presses the lens’s own core questions too: is the deviation locally rational, and what local pressure produced it? Does cross-unit coordination still work given the drift, or does it depend on assumptions no longer met? What is the failure mode if the drifts in different units align? Is the procedure being enforced because it is correct, or merely because it is documented?

What the analysis will not do. It will not take the documented procedure as the truth (when actual practice wasn’t investigated, it says so explicitly); it will not collapse a genuine official-vs-actual divergence into the official version (the divergence is itself the finding); and it will not reframe drift as individual negligence — the lens traces drift to the system that invited it, not to the people who made each locally sensible call.

Origin and evidence

The originating analysis is Scott Snook’s Friendly Fire: The Accidental Shootdown of U.S. Black Hawks over Northern Iraq (2000), which reconstructs the 1994 shootdown and coins the term practical drift for the slow uncoupling of practiced from prescribed behavior under local rationality. Its essential companion is Diane Vaughan’s The Challenger Launch Decision (1996), whose study of NASA’s 1986 launch decision names the parallel mechanism — the normalization of deviance, by which a repeated deviation that never (yet) causes disaster comes to feel normal and turns invisible to those inside the system. Both sit inside the broader frame of James Reason’s Managing the Risks of Organizational Accidents (1997), which describes organizational accidents as the product of latent conditions — dormant weaknesses, built in long before, that lie quietly in a system until active failures and circumstances line them up. The lens sits beside its own family: normalization of deviance (what drift becomes once it turns invisible to insiders), the Swiss cheese model (what aligns when drift erodes multiple units’ assumed safety properties), and normal accident theory (the structural property of complex, tightly-coupled systems that makes aligned drift catastrophic).

Applications and common uses

Practical drift is a working tool wherever a documented procedure governs real work and time has had a chance to bend the two apart.

Safety post-mortems and accident investigation. Its native ground: explaining a failure that has no single culprit by tracing the accumulated local deviations whose gaps aligned — and resisting the pull toward individual blame.
Safety audits and pre-mortems. Catching the drift before the accident — auditing standard procedures against actual practice precisely while the system is still running “fine,” because the smooth running is the complacency that hides the gap.
Organizational risk and high-reliability operations. Diagnosing where cross-unit assumptions have quietly stopped holding in hospitals, aviation, finance, and infrastructure, where coordinated work depends on each unit’s implicit conventions.
Process documentation and improvement. The use that brings it here: mapping the real, current-state process rather than the policy fiction, and producing a deviation register that gives each drift an explicit accept-and-fold-in or reject-and-redesign disposition.

In every case the payoff is the same: the gap between the documented and the lived process is made visible, each deviation is read for local rationality rather than treated as a rule violation, and the silent assumptions that drifted units depend on are surfaced before they can align.

Failure modes and when not to use it

The lens’s characteristic ways of going wrong are catalogued in its Common Failure Modes:

Individual blame. Attributing drift to the negligence of specific actors. The tell: the post-mortem fingers individuals rather than the system. Correction: trace the local conditions that produced the drift — the deviation was almost always the rational response to a real pressure.
Re-enforcement without redesign. Reinstating the original procedure without addressing why the drift occurred. The tell: the same drift returns within months. Correction: revise the procedure to accommodate the conditions, or remove the conditions that force the workaround.
Drift-as-improvement amnesia. Losing track of which drifts are genuine improvements and which are latent risks. The tell: no documented disposition for each observed deviation. Correction: produce a deviation register with explicit accept/reject decisions.

When not to reach for it. When no documented procedure exists, or it was never actually followed, there is no baseline for drift to depart from — the question is design, not deviation. When the system has a single actor and no cross-unit coordination, the lens’s core danger (aligned gaps between drifted units) can’t arise, and a simpler look at one person’s habits suffices. And the lens explains and surfaces drift; it is descriptive, not causal — when the task is to establish why a specific outcome occurred as a chain of causes, that is root-cause analysis’s job, and forcing the drift frame onto it overreaches.

Process Mapping — the analysis this lens informs; documents a process’s real, current-state flow (steps, actors, dependencies, bottlenecks, hand-offs), where practical drift is the discipline that surfaces the gap between the documented procedure and actual practice.
Normalization of Deviance — Diane Vaughan’s companion model: what drift becomes when repetition without disaster makes a deviation feel normal and turns it invisible to those inside the system.
Swiss Cheese Model — the alignment picture: what lines up when drift erodes the assumed safety properties of multiple units, so a hazard passes clean through every layer of defense at once.
Normal Accident Theory — the structural backdrop: the property of complex, tightly-coupled systems that makes aligned drift not just possible but catastrophic when it comes.