Your security tool should tell users what to change, not just what's wrong

Our findings said 'this bucket is public.' Users asked 'what do I change to fix it?' We derived the answer mechanically from the predicate AST — no per-rule authoring needed. Here's how counterfactual reasoning turns detection output into actionable fixes. Finding: CTL.S3.PUBLIC.001 Asset: arn