Use this five-step evidence loop
- Scope: name the authorized hostname or property and the exact surface being checked.
- Baseline observation: record the rule, timestamp, observed value, and bounded result before a change.
- Assigned remediation: record the action, provider or interface, owner, and intended target state.
- Same-rule retest: run the deterministic rule again against the authorized scope after the change.
- Before/after evidence: preserve the original and later observations with their timestamps and content-hash context.
Why a screenshot alone is weak evidence
A dashboard screenshot may be from the wrong account, zone, hostname, or time. It may also show a setting that is saved but not yet visible through the public edge. Pair the screenshot with the authorized hostname, a public observation, and a same-rule retest so the client can follow the causal chain.
Use plain language: “The HTTPS redirect was observed on this hostname at this time, then the same check passed after the change.” Avoid turning a narrow observation into a blanket security, compliance, or certification claim.
Make the client handoff readable
- Lead with the change and the affected scope.
- Show the baseline and retest values side by side.
- Name what remains unknown or outside the check.
- Link the provider action without claiming it was applied automatically.
- State that observations are point-in-time and that a free Public Snapshot does not start recurring monitoring.