Evidence from real activity

Controls draw on what the platform actually recorded: approvals, scans, deploys, access changes. There is no separate evidence pipeline to keep in sync. Key points:

• Evidence is a byproduct of doing the work, not a second job done before a review.
• Each control points to the activity that backs it, so you show the mapping, not a checkbox.