Evaluate named security/governance controls and report where each verdict came from.

Honest about provenance: every finding carries a source (arg | azure_policy | defender), and controls whose signal is not in the available data report not_evaluable rather than guessing. Most controls read the Azure Resource Graph resources row directly (no policy assignment required); guest_config_extension reads guest-config compliance from the ARG policyresources table and is not_evaluable when no policy is assigned. disk_encryption is partial — it confirms encryption-at-host from ARG but cannot see disk-level/ADE encryption, so a missing host-encryption signal is not_evaluable, not fail.

Look up resources with structured, read-only filters.

All filters are combined with AND. Returns an ARG-shaped projection.

Report per-VM patch/update posture from Azure Resource Graph patch assessments.

Honest about provenance: every finding carries source="arg" — verdicts come from the ARG patchassessmentresources table (Azure Update Manager assessment data), never inferred from resource properties alone. A VM whose posture cannot be trusted is not_evaluable — a deallocated/stopped VM (Azure cannot assess a stopped VM) or a VM with no assessment data — with pendingUpdateCount null (unknown, not zero), never a fake "current".