Known constraints

The comparison window is bounded by artifact retention

The assessment snapshot is retained for 90 days by default. A re-assessment more than roughly three months after the previous one finds no predecessor and correctly renders as a first assessment.

Nothing is fabricated in that case, and the pack says which situation it is in. Extending the window means moving the snapshot to other storage, which is an infrastructure change and is not implemented.

One account per engagement

There is no organisation-wide scan and no aggregation across accounts. Assessing several accounts means several engagements.

Point in time

The assessment is triggered, not continuous. It describes the environment as it was when it ran. There is no monitoring, no alerting and no drift detection between assessments.

One role name per account

The role name is fixed per account, which is what lets the role identifier be derived from your account number. It also means one engagement's role is the same role as the next one's, re-tagged and re-dated rather than replaced.

The scanner bounds the security domain

Security coverage is the scanner's catalogue at three severities. GovIntel does not write its own control checks, so a control the scanner does not implement is a control the assessment cannot report.

Individual control results are unaudited

The pipeline is validated end to end against a real account. Whether each control result is correct about the account it describes has not been independently checked.

No peer benchmark

None ships. See Peer benchmarking.

Configuration only

No runtime behaviour, no traffic analysis, no log content, and no knowledge of what any workload does or what it is worth.