Drift
A executive requested a site unblocked so they could finish a presentation. The ticket closed. The rule is still there.
The change was reasonable on the day. A site had to be reachable before the presentation. Nobody wrote down that the allow was temporary. A month later the same customer still has the hole, and the engineer who made it does not remember which tenant.
The next person sees a URL rule with no note attached. It looks like policy. It was a favour that outlived the meeting.
Comparing every customer with every other customer is noise. A school and a bank are not meant to look the same. The useful comparison is against the standard for that service: the URL policy, SSL inspection, and the exceptions you agreed to.
NUMBAT snapshots the tenant and shows what moved, when, and who did it. Tuesday's drift is a list of tenants, not a tour of every Zscaler portal.
The snapshot is the record. The engineer who does not remember the tenant is not.
The diff shows whether the move left the scope you sold. A rule that was fine on the day can sit outside that scope a month later.
The spreadsheet of exceptions someone keeps in a folder is already behind the tenant. The comparison runs from the snapshot.
An exception can have an end date. The presentation allow expires when the meeting is over, instead of waiting for someone to remember it.
Without that date, the outage fix becomes the new policy. Drift that is only reviewed at audit time has already been in production for months.
See what moved since the snapshot.