{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T14:13:51.913Z",
  "record_id": "VXI-EXT-PROCUREMENT-MACIE-SAMPLING-01-v1",
  "record_kind": "external_reference",
  "title": "Macie discovery: Sampling and inventory coverage",
  "system": "Amazon Macie",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does Macie automated discovery prove every object in an S3 bucket was inspected?",
  "near_questions": [
    "Was this automated discovery or a configured job?",
    "Which objects were selected?",
    "How does sampling affect the claim?",
    "Which buckets were in scope?",
    "Were custom identifiers configured?",
    "Could allow lists exclude matches?",
    "What objects remain unassessed?",
    "Does no finding prove no sensitive data?",
    "When was inventory evaluated?",
    "Did a targeted job use narrower criteria?",
    "What evidence supports the coverage percentage?",
    "Can I retain the discovery-scope review?"
  ],
  "supported_claims": [
    {
      "claim": "Automated discovery evaluates bucket inventory and selects representative objects through sampling. Discovery jobs allow more targeted scope and depth. The existence of automated discovery or no findings does not establish exhaustive inspection. Keep selected objects, configured identifiers and analysis results distinct from the total bucket inventory.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Automated discovery evaluates bucket inventory and selects representative objects through sampling. Discovery jobs allow more targeted scope and depth. The existence of automated discovery or no findings does not establish exhaustive inspection. Keep selected objects, configured identifiers and analysis results distinct from the total bucket inventory.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Amazon Macie: Discovering sensitive data",
    "source_url": "https://docs.aws.amazon.com/macie/latest/user/data-classification.html",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-MACIE-SAMPLING-01-v1",
    "candidate_record_sha256": "11be55677354a3e05abc15b4318daa18fec2344a41397c7146ce550c508b0c61",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Automated discovery evaluates bucket inventory and selects representative objects through sampling. Discovery jobs allow more targeted scope and depth. The existence of automated discovery or no findings does not establish exhaustive inspection. Keep selected objects, configured identifiers and analysis results distinct from the total bucket inventory.",
    "required_buyer_context": "Discovery mode, object inventory, selection criteria, identifiers and dated analysis results. Effective configuration and dated operational evidence have not been inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Automated discovery scans every stored object.",
    "documented_statement": {
      "status": "documented",
      "statement": "Automated discovery evaluates bucket inventory and selects representative objects through sampling. Discovery jobs allow more targeted scope and depth. The existence of automated discovery or no findings does not establish exhaustive inspection. Keep selected objects, configured identifiers and analysis results distinct from the total bucket inventory.",
      "source_ids": [
        "macie"
      ]
    },
    "buyer_evidence_required": [
      "Discovery mode and selected bucket/object scope.",
      "Analysis results, identifiers and allow lists.",
      "Inventory reconciliation and unassessed objects."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require explicit scope reconciliation before asserting complete bucket coverage."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "macie",
        "url": "https://docs.aws.amazon.com/macie/latest/user/data-classification.html",
        "final_url": "https://docs.aws.amazon.com/macie/latest/user/data-classification.html",
        "title": "Amazon Macie: Discovering sensitive data",
        "checked_on": "2026-10-16",
        "sha256": "f322361690180eb1870f74d8c921428af58b421484d3a2136faa137a505981c4",
        "bytes": 18345
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Save the distinction between sampled discovery and an exhaustive-inspection claim.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Discovery mode, object inventory, selection criteria, identifiers and dated analysis results."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#macie-automated-discovery-sampling-not-exhaustive-scan",
  "machine_readable_record": "/varexis-index/records/macie-automated-discovery-sampling-not-exhaustive-scan.json"
}