sha3:1376adb55724cd88ae22346d3ab2f7a1486c97856f2351cf56c6598e2af221caIntactPROOF LAYER 01 / STATE
What was true, as of a time you can name.
sha3:6b028eba85bfIndependently verifiablec753fa1b8b86a99553ad5bba4c75d0c1f1d22e8ea1a91e2619e969ea2fe11b7cprev:e92b4ef53279An assessor names a date three months back. Produce the configuration.
Q1Can you produce the configuration of your environment as of a date someone else picks, or only as of today?
The request is ordinary. An assessor names a date three months back and asks what your environment was on that day: which storage accounts enforced encryption at rest, which network paths were open, which identities held which roles, and inside which declared boundary each resource sat. The date is theirs, not yours. That is the whole difficulty.
Dashboards overwrite themselves. A console renders current state, and current state is the one thing nobody asked about. Activity logs record that something changed, not what everything was at a moment. Screenshots preserve whatever someone thought to capture, on the day they thought to capture it. When the date arrives from outside, none of these reconstruct the moment. They reconstruct your best story about it.
Proof of State is the record of the moment itself: point-in-time captures of resource configuration, taken from the cloud provider APIs, content hashed, chained, and kept. As of stops being a reconstruction project and becomes a parameter you pass.
State is the first of three proofs. Proof of Change records what altered the estate and under what authority. Proof of Agency records what your machines were allowed to do before they did it. All three commit to the same evidence base.
7862dd1c94e25d6dca8895cb8c7599a8c34cf4c9789b1d4f6f126cc4a92bd795prev:c753fa1b8b86What we actually record
One record per resource, per capture, whether the capture ran on schedule or a change triggered it. The claim is not a sentence about the resource; it is the raw provider response underneath, hashed. The field names below are the real ones.
- resource.id
- The full provider path of the resource this record is about: the identifier the cloud API resolves, not a friendly name someone typed into a spreadsheet.
- control.mapping
- The control statements this state bears on, stored on the record. One encryption setting can evidence NIST 800-171 3.13.16 and 800-53 SC-28 at once, and the mapping is written down, not implied.
- asset.scope
- The declared boundary the resource sits in: CUI enclave, environment, production class. Scoping arguments get settled by this field instead of by the meeting.
- state.proof
- The raw cloud API response that grounds the claim, stored verbatim. If a narrative and this payload ever disagree, the payload wins.
- content.hash
- SHA3-256 digest of the record content. Anyone holding the record can recompute it; a matching digest means unaltered content, with no trust in us required.
- captured.at
- UTC timestamp of the capture. Every claim in the evidence base reads as of this field, not as of whenever someone last looked.
- retention
- Seven years, append-only JSONL. A record is never updated in place; newer state is a new record, chained after the old one.
- regenerable.to
- Any historical timestamp inside retention. The assessor picks the date; the evidence base rebuilds the environment as of that date from the records written then.
Exhibit S-1 · collectors writing hashed artifacts per control: the record family above, as it lands. Illustrative demo data; the interface is real.
# storage account encryption at rest, as of a date the assessor named record state-2026-05-14-492118 captured.at 2026-05-14T03:10:22Z resource.id /subscriptions/1e6f4c9a/resourceGroups/rg-cui-prod /providers/Microsoft.Storage/storageAccounts/stcuiprod01 control.mapping 800-171 3.13.16 800-53 SC-28 CMMC SC.L2-3.13.16 asset.scope cui-enclave/production state.proof raw provider response, stored verbatim encryption.keySource Microsoft.Keyvault encryption.requireInfrastructureEncryption true supportsHttpsTrafficOnly true minimumTlsVersion TLS1_2 content.hash sha3:5b19d4a3c7e2 chain.prev sha3:f04a11c89bd3 scope.declared 2 of 2 connected subscriptions observed, no gap this interval retention seven years (until 2033-05-14) regenerable.to any timestamp since first capture
271a782586f858845edeeb71eee46d8739df370576ad4343514486f98cc1452eprev:7862dd1c94e2How the record is verified
Each state record is content hashed with SHA3-256 and carries the digest of the record before it, so every line commits to the entire history above it. The log is append-only: a correction is a new record, never an edit. Alter one record, anywhere, at any time, and every digest after it stops recomputing. Verification is a recomputation, not an assertion: run the chain from the first record forward and it returns one of two answers, intact, or the sequence number of the first record that breaks.
A second party can do that recomputation without our help. The records, the digests, and the chain rule are everything required: no PolicyCortex account, no API of ours in the loop, no trust in the operator whose environment is being examined. Retention is seven years, and because the log is a chain rather than a table, producing the environment as of any date is a replay, not an archaeology project.
The documents assessors ask for are projections of this record, not parallel artifacts maintained by hand. SSP, POA&M, and SAR generate from one implementation record, and the package exports as OSCAL 1.1.2. The same record ships in assessor handoff shape for the eMASS and C3PAO exchange, and in program-office shapes for federal environments. The document is never the source. The chain is.
How the chain is constructed and where it lives inside your tenant is covered in the architecture. There is no telemetry pipeline to PolicyCortex servers and no egress of evidence. Verification works precisely because nothing about it depends on us.
$ pcx verify state as-of=2026-05-14 records 492118 recomputed 492118 head sha3:2f8ce1a90b47 gaps 1 declared (interval and reason on record) result INTACT $ pcx verify state (same log after one record edited in place) result BROKEN at seq 310442 note every digest from 310443 onward fails to recompute
781ea88d3d049cc55743e8575c7e62e5f6de5913e1c1f0dad06e81a4bc625d29prev:271a782586f8What this layer does not do
record gap-2026-05-02-000841 scope subscription sb-eng-sandbox interval 2026-05-02T11:40:00Z to 2026-05-02T14:05:31Z reason collector credential expired; rotated 14:05:31Z effect no state records for this scope in this interval declared true chain.prev sha3:77b3f0a2d941
1376adb55724cd88ae22346d3ab2f7a1486c97856f2351cf56c6598e2af221caprev:781ea88d3d04Where it maps
State evidence files under continuous monitoring, with the audit family governing how the records themselves are protected. The mapping is quiet on purpose: the record is the product, and the rows below are where assessors expect to find it.
- NIST 800-53
- CA-7 continuous monitoring grounded in point-in-time records, with the AU family covering how those records are protected, retained, and reviewed.
- NIST 800-171 / CMMC Level 2
- One evidence base for the 110 requirements: state records handed to your assessor as generated evidence with the raw payload attached.
- FedRAMP 20x
- Machine-readable by construction. State and control mappings export as OSCAL 1.1.2 rather than as documents transcribed from screenshots.
- MITRE ATT&CK
- Configuration tampering becomes detectable because expected state is on record: an unexplained delta from the last capture anchors the detection.
Exhibit S-2 · the 110-requirement table where state evidence files, control by control. Illustrative demo data; the interface is real.
Reconstruct the state a reviewer actually asks for.
Request verification