Evidence and coverage

ModelFence distinguishes the origin of a claim from its severity. A critical-looking relationship in a configuration file is not automatically an observed production event.

Evidence state	What it means	What it does not prove
Configured	A supported source declares the setting or relationship.	That the configuration is deployed or its permission is effective.
Observed	An instrumented agent reported it through runtime telemetry.	That all activity was observed, or that telemetry is independently complete.
Verified effective	An implemented active check confirmed a specific live-system behavior.	That every operation or authorization path was tested.
Inferred	The relationship was derived from other evidence.	Direct observation or a successful live check.

Read a result in context

Open the evidence attached to the finding or asset. Check the source, collection time, scan and rule version, and whether the data is labeled synthetic. Redaction may remove credential values; it should not be interpreted as evidence that the original source was harmless.

Confidence describes how strongly the evidence supports the finding. Severity describes the potential impact of the condition. Status describes your workflow decision. Resolving or accepting risk does not rewrite the source evidence.

Coverage defines the boundary

Coverage summarizes capabilities and their source-specific cells:

Status	What to do
Evaluated	Review the result and evaluation time.
Partial	Read what was skipped or failed and close the gap.
Not configured	Connect a source, send telemetry or run the applicable test.
Unsupported	Use another method; ModelFence does not evaluate this capability.
Permission denied	Correct source authorization and rerun the operation.
Outdated	Check source health and evaluate again.

The summary counts fully evaluated supported capabilities. Unsupported capabilities do not inflate that denominator. A source with no supported files, an unavailable integration or a scan that never completed cannot establish absence of risk.

For a repeatable review, record the finding, source run and evaluation time together. Reports preserve this provenance when exporting findings.