Backup Monitoring Needs UNKNOWN as a Real State
Least-privilege monitoring sometimes cannot read protected backup evidence, and treating that access failure as healthy would be dangerous.
UNKNOWN
UNKNOWN Is Better Than a False FAIL When Metadata Is Restricted
A posture check should distinguish evidence it cannot read from evidence that proves the system is wrong.
UNKNOWN and FAIL Mean Different Things in Backup Monitoring
Protected evidence that a low-privilege checker cannot read should not be reported as healthy or corrupt.