What was true, as of a time you can name.

The request is ordinary. An assessor names a date three months back and asks what your environment was on that day: which storage accounts enforced encryption at rest, which network paths were open, which identities held which roles, and inside which declared boundary each resource sat. The date is theirs, not yours. That is the whole difficulty.

Dashboards overwrite themselves. A console renders current state, and current state is the one thing nobody asked about. Activity logs record that something changed, not what everything was at a moment. Screenshots preserve whatever someone thought to capture, on the day they thought to capture it. When the date arrives from outside, none of these reconstruct the moment. They reconstruct your best story about it.

Proof of State is the record of the moment itself: point-in-time captures of resource configuration, taken from the cloud provider APIs, content hashed, chained, and kept. As of stops being a reconstruction project and becomes a parameter you pass.

State is the first of three proofs. Proof of Change records what altered the estate and under what authority. Proof of Agency records what your machines were allowed to do before they did it. All three commit to the same evidence base.

One record per resource, per capture, whether the capture ran on schedule or a change triggered it. The claim is not a sentence about the resource; it is the raw provider response underneath, hashed. The field names below are the real ones.

Each state record is content hashed with SHA3-256 and carries the digest of the record before it, so every line commits to the entire history above it. The log is append-only: a correction is a new record, never an edit. Alter one record, anywhere, at any time, and every digest after it stops recomputing. Verification is a recomputation, not an assertion: run the chain from the first record forward and it returns one of two answers, intact, or the sequence number of the first record that breaks.

A second party can do that recomputation without our help. The records, the digests, and the chain rule are everything required: no PolicyCortex account, no API of ours in the loop, no trust in the operator whose environment is being examined. Retention is seven years, and because the log is a chain rather than a table, producing the environment as of any date is a replay, not an archaeology project.

The documents assessors ask for are projections of this record, not parallel artifacts maintained by hand. SSP, POA&M, and SAR generate from one implementation record, and the package exports as OSCAL 1.1.2. The same record ships in assessor handoff shape for the eMASS and C3PAO exchange, and in program-office shapes for federal environments. The document is never the source. The chain is.

How the chain is constructed and where it lives inside your tenant is covered in the architecture. There is no telemetry pipeline to PolicyCortex servers and no egress of evidence. Verification works precisely because nothing about it depends on us.

State evidence files under continuous monitoring, with the audit family governing how the records themselves are protected. The mapping is quiet on purpose: the record is the product, and the rows below are where assessors expect to find it.