Federated control evidence proves coverage by connecting process documentation and live cloud facts to the same control model. The evidence can stay in authoritative systems, but its source, scope, capture time, owner, validity, and review state must be visible in one assurance graph.