Evidence, History, and Result Integrity in Panaptico

Panaptico treats evidence as a first-class property of every result. When you see At target, Off target, Unknown, or Unobserved, that label is backed by the full request, response, scope, and timestamp that produced it. This page explains what evidence is captured, how history is maintained, and why missing data never becomes a manufactured pass.

​

What every result carries

Each evaluation in Panaptico includes a standard evidence envelope: This envelope is stored with every result, so you can reconstruct exactly how a conclusion was reached at any point in time.

​

Full history and audit export

Panaptico retains the complete history of every Signal, tracked field, and Initiative evaluation. You can:

• Browse historical results in the dashboard by time range
• Compare two points in time to see when a resource drifted
• Export evidence bundles for auditors or compliance reviews
• Query history via the API for custom reporting

Because data lands in your lake, you also have direct access to the underlying raw telemetry for long-term retention or external analysis.

​

Unknown and Unobserved

Panaptico uses four result states. Two of them exist specifically to prevent silent failures:

• Unknown — the provider returned data, but this specific field or resource was not in scope. For example, the IAM credential lacks permission to read S3 bucket policies, so bucket policy fields are Unknown even though the bucket list was retrieved.
• Unobserved — no data arrived within the expected window. This can happen when a stream is down, a probe target is unreachable, or a scheduled API pull failed.

In both cases, Panaptico does not inherit the last known good value, interpolate, or guess. The result is explicitly marked as incomplete evidence. This ensures that:

• Auditors see exactly what was and was not verified
• Drift does not hide behind stale data
• Coverage gaps are visible and actionable

​

Why missing evidence is never a pass

Many monitoring tools silently carry forward the last known state when data stops arriving. Panaptico does not. If a firewall rule was At target yesterday but the provider has not responded today, today’s result is Unobserved. The historical record still shows yesterday’s At target, but the current state is honest about the gap. This behavior is essential for continuous control assurance and audit readiness. You can prove not only what was verified, but also what was attempted and failed to verify.

​

Next steps