An IaC validation stage ignores tag-only drift while a compliance controller uses those tags to permit or deny later runtime changes during a failover rehearsal

The infrastructure shape matches expectations, yet its governance behavior does not. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.