Compare recorded agent configuration with current source and understand changed approval bindings.

Compare an agent with its recorded execution

Use agent inventory to inspect the declared agent and compare available source identity with its latest identified execution. Use change impact to compare a candidate workspace with a baseline before running it.

Before you begin

Keep the current workspace source available. For runtime comparison, retain local run history or connect a portal workspace with reported agent execution. An agent declaration without a comparable recorded run has unknown drift; inventory alone does not prove what executed.

Inspect an agent

actspan agents list --workspace-dir workspace.yaml --json
actspan agents show "AGENT_NAME" --workspace-dir workspace.yaml --json

Review the declaration, available runtime identity and drift fields. In the portal, open the workspace's Agents view for the corresponding comparison. Expected result: the agent's declaration is visible, and its drift result explains which available fields matched, changed or could not be compared.

Result	Meaning	Next action
`matched`	The available compared identities agree	Review the reported scope and execution evidence
`changed`	At least one compared identity differs	Inspect the changed fields and evaluate the candidate
`unknown`	A comparable run, source or fingerprint is missing	Report a new identified run or restore the missing source evidence

Native comparison uses reporter-supplied workspace-file identity, and base policy identity where the reporting path supplies it. It compares the latest identified agent run, without substituting an older matching run. Raw source byte changes can produce drift even when the edit is formatting-only.

External-agent comparison uses available declaration, entrypoint-code and policy fingerprints. Its broader runtime identity also records adapter/framework versions. Read which fields were compared; a partial identity is not a clean bill of health.

Compare a candidate before running it

Retain a reviewed baseline workspace, then compare the proposed source:

actspan impact workspace.yaml --baseline workspace.baseline.yaml --format json

This comparison makes no provider calls. Inspect affected workflows, owners, dependencies and linked evaluation recommendations. Run the relevant evaluations deliberately; impact --run-evals is a separate option that can execute model calls and incur charges. Passing an inventory comparison does not establish that evaluations passed.

Respond to a changed configuration

Review the intended diff, run its applicable control checks/evaluations, then record a new execution of the approved candidate. A changed status is information for review; inventory does not automatically rewrite a workspace, repair a deployment or undo previous business actions.

A native pending approval has a separate effective-configuration binding. An authored behavior change after the pause refuses continuation with APPROVAL_CONFIGURATION_CHANGED. Follow the approval guide to request a new decision for the candidate. This is a different comparison from the inventory's source-byte drift view.

Source fingerprints do not cover every imported helper, installed dependency, runtime override, remote MCP service, resolved secret or downstream business record. Reporter-supplied hashes are evidence from that execution path, not independent attestation that every possible call was governed.