How to read a report, section by section

30-second answer

Provenance, attention, summary, then the findings grouped by outcome. The order is deliberate: you learn where the evidence came from before you read a single conclusion drawn from it.

The header is provenance, and it comes first

# Governance report: Archive

- Resource: `<unknown>` (list)
- Collected: 2026-08-05T14:02:11Z by `spo-collector` 0.1.0
- Source: SharePoint Online via PnP.PowerShell / CSOM
- Rules: shipped with this version
- Identity: application, scopes: Sites.Read.All

Every line is load bearing.

Collected is when, and by what. A conclusion is only as current as the evidence under it.

Identity is who was looking, and with what scopes. A report produced by an identity that could not see part of the estate is a report about part of the estate.

Rules: shipped with this version says the packaged rules decided this. A report produced with --rules pointing at a local directory says so instead, which is what stops an edited rule set passing as the shipped one.

Attention is not severity

## Attention

**Something here is outside what the vendor documents.**

- 1 of 3 findings failed against something the vendor documents

Attention is the engine's answer to "what should I look at first", and it is computed from what the findings rest on rather than from a severity column. A failure against a documented-limit outranks a departure from documented-guidance because one is a boundary the product imposes and the other is advice.

See outcome, severity and attention.

The summary refuses to round up

3 rules evaluated. **1 produced an answer.**

| Outcome | Count |
|---|---|
| Fail | 1 |
| Invalid evidence | 0 |
| Error | 0 |
| Unknown | 2 |
| Pass | 0 |
| Not applicable | 0 |

2 rules could not be decided. That is not compliance: missing evidence is a
fact about collection, not about the resource.

Read the second line before the table. 1 produced an answer out of 3. A report that led with "1 failure" would be describing a third of the run as if it were all of it.

The sentence under the table is printed by the engine, not written here. It is the single most important sentence in the document.

Every finding carries its own justification

### SPO-LIST-001 v2.0

The list holds 148000 items, above Microsoft's documented limit of 100,000,
and still inherits its permissions.

- Basis: **documented-limit**, a boundary the product imposes
- Severity: medium
- Evidence: `items.count` = 148000, `permissions.inheritance_broken` = false
- Source: [SharePoint limits, ...](https://learn.microsoft.com/...), checked 2026-08-05

The rule id and its version. The basis, with its one line gloss. The actual evidence values, so the arithmetic is checkable. The sources, with the date each was checked.

An unknown finding carries the same structure, and its evidence line shows why it could not decide:

- Evidence: `permissions.unique_scope_count` = <missing>

What to do is separate from what was found

What to do appears under a finding when the rule carries remediation. It is a distinct field precisely so nobody reads a recommendation as part of the observation.

The three formats agree

markdown, json and html are renderings of the same run. A finding present in one is present in all three, and the JSON is not a reduced machine view of a fuller human document.