Your pipeline has six gates. None of them check your brand.

1.The gap the tooling never filled

Design tokens flow one way. Figma to Style Dictionary to CSS variables to components. Every step in that chain is checked against the step before it. Nothing checks the last step against reality. Once the CSS is compiled and the page is rendered, the design system stops being a system and becomes an assumption.

Chromatic will tell you a component changed. It will not tell you the change moved your primary from #EA580C to #EA5814, that a card radius crept from 12px to 14px, or that your muted text now fails contrast on the background you shipped last week. Pixels and tokens are different signals. A restyle can pass a visual regression suite and still break the brand.

That gap was survivable when a design system changed four times a year and every change passed through one person who knew it by heart. It is not survivable now.

2.Agents made the gap urgent

Generating UI is a solved problem. Claude, Copilot and Cursor produce plausible interfaces faster than any team can review them. Plausible is the operative word. An agent picks a hover state that is close to your brand color. It picks a spacing value that is close to your scale. It picks a heading size that is close to your type ramp. Close is exactly the failure no reviewer catches at 5pm on a Friday, and close compounds across a hundred merges.

This is the part people get wrong when they say design systems are dying. They are not. What is dying is the model where a system is maintained by human vigilance. Vigilance does not scale to the volume of UI that ships now. Enforcement does.

3.What a brand gate actually is

The gate is not complicated, which is the point. It has three parts.

A baseline. One extraction of your production design system that you looked at and decided was correct. Pin it. It is a lockfile for your brand, and like a lockfile it is worth nothing until it is committed and enforced.

A comparison. Every pull request already produces a preview URL. Extract the rendered tokens from that URL and compare them to the baseline. Not the source CSS, the rendered state, because rendered state is what your users get after the cascade, the theme layer, the component overrides, and whatever the agent added last night.

An exit code. The run exits 1 when the drift score crosses your limit, and the check goes red exactly like a failing test, with a self-contained HTML report attached as a build artifact. That is the whole mechanism. It is a linter, and the thing it lints is your brand.

4.Two ways to run it

The gate does not require an account. You can run the whole loop from the CLI, and plenty of teams should start there. What the App adds is memory.

The reason to move up is not convenience. It is that a JSON file in one repo cannot answer a question that spans repos: are our four products still the same brand? That question needs a place to stand outside any single codebase. What the App does covers the rest.

5.Drift is not always a bug

The naive version of this gate is a tripwire that screams at every change. That version gets disabled in a week.

Most drift is a decision nobody wrote down. A designer darkened the primary for contrast. A team introduced a new surface color for a new feature. Those are legitimate, and the correct response is not to block them. It is to make them explicit. Someone reads the diff, agrees with it, and runs the same command with --approve to promote it to the new baseline. The change becomes a decision with an author and a timestamp instead of an accident nobody can date.

That is the difference between detection and governance. Detection tells you a value moved. Governance tells you who decided it should.

6.Accessibility rides in the same loop

The European Accessibility Act has applied since June 2025. For a large share of digital products and services sold in the EU, conformance in practice means WCAG 2.1 AA, and enforcement is set by each member state. In the US the ADA keeps producing thousands of web accessibility lawsuits a year.

Contrast is the most common failure by a wide margin, and it is the one a redesign reintroduces most easily. One brand color darkened by half a step, one hover state generated by an agent, and a page that passed an audit last quarter fails today. The audit was a point in time. The failure is continuous. The only sane place to check contrast is the same place you check everything else that regresses: the pull request.

7.The uncomfortable version of the argument

If your design system exists only in Figma and a documentation site, you do not have a design system. You have a proposal. The system is whatever your production CSS actually renders, and for most teams nobody has read it.

Read it. Pin the version you are proud of. Fail the build when it drifts. The rest is bookkeeping, and machines are good at bookkeeping. Token drift is silent covers what the diff looks like once the gate starts catching things.