Prove It Ngày 03: Prove It Arena

Compared with a default environment, what is unusual here? Group it by cost optimization, security, performance efficiency, reliability and operational excellence.
Which of these is a real risk with evidence behind it, and which only looks alarming? Show the raw output for each.

# Round 1: Find the Gaps

## 01 What we looked at
- Environment and scope reached:
- Blocked (role could not look):

## 02 What we would fix (biggest impact first)
1. Finding:
   - Pillar:
   - Evidence (source, scope, time):
   - Label: Verified / Inferred / Assumed

## 03 What needs a person
- Change that needs approval, and who approves it:
- Dropped on purpose, and why:

For the finding I am about to submit, give me the source, scope and time that prove it, and tell me what would make it wrong.

Give me at least two explanations for this symptom that fit the evidence so far, and the reading that would rule each one out.
Which resource can you show actually changed, with a timestamp? Which ones are you only assuming changed?

# Round 2: Find the Cause

## 01 Question and scope
What is broken, for whom, since when. What our access could not see.

## 02 Hypotheses, one ruled out
- H1:
- H2:
- Ruled out by (reading, time):

## 03 Evidence
Source, scope and time for each item, with raw output.
- Label: Verified / Inferred / Assumed / Blocked

## 04 Mechanism
Symptom -> ... -> changed resource. The edge we could not prove:

## 05 Root cause and response
- Resource whose configuration changed, and when:
- Conditions we cannot date (contributing factors):
- Recommended change, who approves it, and the check that proves it worked: