# Absence of Evidence Is Not Revocation
URL: https://docs.autociso.io/product/access/absence-of-evidence/
Description: Why an access item missing from a later collection does not mean the access was removed, and the one rule that makes a comparison trustworthy.

Absence of evidence is not revocation. If an access item (a grant, an account or an app connection) was in one collection of data and is missing from the next, that tells you the item was not seen. It does not tell you the access was removed.

This page explains why, and gives you a rule you can apply to any access review, whatever tool produced the data.

## Definitions

- **Collection**: one attempt to read the current list of access items from a source system, such as an admin API or an export file.
- **Observed**: the item appeared in a collection.
- **Not observed**: the item did not appear in a collection. This is a statement about the collection, not about the access.
- **Revoked**: the access no longer works. You only know this from a source that says so directly, for example a status field, a deletion record or a failed sign-in test.

## Why an item can be missing without being removed

Three common causes make a later collection look smaller than the real situation.

### 1. Incomplete pagination

Large lists are returned in pages. A client that stops after page one, or loses its place after a retry, sees only part of the list. Microsoft Graph, for example, returns results in pages and gives a link to the next page until there are no more; to read everything, a client must keep following those links ([Microsoft Learn: Paging Microsoft Graph data in your app](https://learn.microsoft.com/en-us/graph/paging), checked 11 October 2026). The same page notes that a page of results can contain zero or more items, and that page sizes and paging behaviour differ between APIs ([same source](https://learn.microsoft.com/en-us/graph/paging), checked 11 October 2026). A short or empty page is therefore not proof that the list has ended.

### 2. Different filters or scope

If the second collection asked for a narrower set (another date window, another status filter, fewer sources, a lower row cap), items outside that set disappear from the results while still existing in the system.

### 3. Replication or index lag

Some systems answer queries from a copy or an index that trails the live data. Microsoft documents that some Graph queries are served by a separate index and need the `ConsistencyLevel: eventual` header ([Microsoft Learn: Advanced query capabilities in Microsoft Graph](https://learn.microsoft.com/en-us/graph/aad-advanced-queries), checked 11 October 2026). Whatever the source, a read made soon after a change can miss that change in either direction: a new item may be absent, and a removed item may still appear.

## The rule: compare complete, comparable collections

Treat an item as gone only when all of these hold:

1. **The later collection finished.** It reached the end of every list and reported no errors, throttling gaps or row caps that cut it short.
2. **The two collections are comparable.** Same source, same scope, same filters, same fields.
3. **The later collection is far enough from the change.** Allow for lag before you read an absence as meaningful.
4. **The gap is stated.** The record says which collection saw the item last and which complete, comparable collection did not.

If any of these fails, the honest result is "cannot verify". Record that, and collect again.

## Wording to use and avoid

| Avoid | Use instead |
|---|---|
| "Access was revoked." (item is only missing) | "Not observed in run 12." |
| "The account was removed." | "The item was absent from a later complete, comparable collection." |
| "Nothing is missing." (run was partial) | "Run incomplete: cannot verify." |
| "Verified." | "Verified by run 12." Name the run, and say so when the source is an export or a screenshot, which carries lower confidence. |

Add the run identifier every time. A statement without one cannot be checked.

## What this means for your own reviews

- Keep each collection's date, scope and completeness next to its results.
- When someone says "it's gone", ask which complete, comparable collection showed that.
- If you must report on an item you only failed to see, report it as not observed and state what you will do to confirm.

## Sources

Microsoft Learn pages checked on 11 October 2026:

- [Paging Microsoft Graph data in your app](https://learn.microsoft.com/en-us/graph/paging)
- [Advanced query capabilities in Microsoft Graph](https://learn.microsoft.com/en-us/graph/aad-advanced-queries)
- [Best practices for working with Microsoft Graph](https://learn.microsoft.com/en-us/graph/best-practices-concept)