Nine months after go-live, internal audit asks a simple question: do the firewall rules running in production today match the ones that were approved? You run terraform plan to prove it. Fourteen changes come back. Three are rule edits someone made in the portal during an incident. One opened a port …