When AzureProof flags a control and why.
Every resource in scope satisfies the control predicate.
The control passes today but a configuration drift is likely (e.g. soft-deleted resource recently restored).
At least one in-scope resource violates the control. The Reports page lists each failing resource and a remediation hint.