Verification
What GovIntel validates about itself
What the test suites and the live validation actually prove, and the one significant thing that remains unproven and is stated rather than implied.
Live validation
The full pipeline was executed end to end against a real AWS account on 2026-08-16, through the same federated access path a customer engagement uses. Two runs concluded successfully and produced board packs.
| Phase | Result |
|---|---|
| Access boundary | Every collector action allowed; every data-plane action explicitly denied |
| Trust policy, read from IAM | Web identity only, audience pinned, subject pinned, session names constrained, expiry enforced |
| Direct assume attempt by a non-federated principal | Refused. The role is reachable only through the federated path |
| Collectors against real AWS | Passed |
| Control checks | 146 controls evaluated, 76 failing |
| Scoring | Produced a rating at High confidence |
| Deliverable | Board pack rendered and delivered |
Three defects surfaced that nothing offline could reach, each triggered only by running for real. All three were fixed and re-verified, and the confirming run produced an identical score with an internally consistent evidence manifest.
What the automated suites cover
| Suite | Proves | Basis |
|---|---|---|
| Engine | Scoring, gating, disclosure, determinism | Synthetic evidence at realistic volume |
| Collectors | Collector logic, error handling, region fan-out | Synthetic, with AWS calls stubbed |
| Access boundary | The role matches the code: no grant without a caller, no caller without a grant | Static |
| Workflow contract | Run correlation, artifact separation, version pinning, offering gate | Static |
What is not proven
The correctness of individual control results has not been independently audited.
The pipeline is proven to produce a defensible number from real evidence. Whether each of those control results is right about the account it describes is a different question, and it requires a person who knows the environment to read the pack and disagree with it.
That is stated here rather than left to be discovered. It is also the check most worth doing, and you are better placed to do it than we are. See Trace a finding to a resource.
What would close it
One assessment where a reviewer walks the top failing controls back to the actual resources and confirms each one.