How should configuration drift be designed for production?

For production, detect drift with scheduled plans or inventory checks, restrict manual modification, import legitimate resources into IaC, document emergency changes, and reconcile differences quickly. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.