PlumbLine detects out-of-band AWS changes by consuming Terraform plan JSON — it reads what Terraform already compared, then adds attribution, replay, and safe remediation. It never replaces Terraform's diff engine and never applies changes without a human-reviewed proposal.