Drift is the reason all of this exists. Three flavors, three detection methods.

Input drift. User query distribution shifts. A new product feature ships and 12% of incoming queries are now about it. A localization launch and suddenly half the traffic is Spanish. Detection: cluster the embeddings of incoming queries on a rolling 7-day window and compare to the previous window. New clusters or shifted cluster sizes are the signal. Cheap version: track per-language counts, top-N tokens, average query length over time and alert on step changes.

Model drift. The provider silently changes the model. Defense in two parts. (1) Pin versions: claude-opus-4-7, not claude-opus-latest. The pinned version eventually retires (Anthropic gives notice), but until then you control the upgrade. (2) Run a canary set — 50-100 fixed prompts you re-run weekly against your production model and log the outputs. Diff against the baseline. Any meaningful change in output (semantic similarity drop, length change, refusal-rate change) is a flag. The canary is also how you decide whether to upgrade to the next version when the current one retires.

Context drift (RAG-specific). Your knowledge base changed: docs got rewritten, articles were deprecated, a re-chunking pass ran. Retrievals that were good last month are now stale. Detection: a gold eval set of (query, expected-doc-id) pairs, re-run weekly. If recall@5 against the gold set drops, your retrieval quality has shifted even though the model and prompt are unchanged.

The three detectors are independent. You need all three because each isolates a different cause — fixing the wrong one wastes a sprint.