Treat provider configuration as a first-class control. Put it in your narratives and collect evidence the same way you do for ...