A computer-implemented method comprising: receiving an indication of a change involving of one or more of code, a policy, a network configuration, or a governance requirement rule impacting a resource in a provider network for an account that is to be analyzed using one or more governance requirement rules; determining one or more governance requirement rules to evaluate for compliance after the update; evaluating the determined one or more governance requirement rules for compliance using one or more reasoning engines according to one or more policies; and making a result of the evaluating available to a user, characterized in that the determined one or more governance requirement rules relates to data privacy and evaluating the determined one or more governance requirement rules comprises: determining a first propositional logic based at least in part on a first set of security permissions; determining a second propositional logic based at least in part on a second set of security permissions; determining the first propositional logic and the second propositional logic lack equivalency using the first propositional logic and the second propositional logic; and providing an indication that the first set of security permissions and the second set of security permissions lack equivalency, wherein the method does not comprise evaluating the determined one or more governance requirement rules as each of a plurality of said changes is indicated, but instead comprises evaluating the determined one or more governance requirement rules when a threshold number of changes have been indicated. receiving an indication of a change involving of one or more of code, a policy, a network configuration, or a governance requirement rule impacting a resource in a provider network for an account that is to be analyzed using one or more governance requirement rules; determining one or more governance requirement rules to evaluate for compliance after the update; evaluating the determined one or more governance requirement rules for compliance using one or more reasoning engines according to one or more policies; and making a result of the evaluating available to a user, characterized in that the determined one or more governance requirement rules relates to data privacy and evaluating the determined one or more governance requirement rules comprises: determining a first propositional logic based at least in part on a first set of security permissions; determining a second propositional logic based at least in part on a second set of security permissions; determining the first propositional logic and the second propositional logic lack equivalency using the first propositional logic and the second propositional logic; and providing an indication that the first set of security permissions and the second set of security permissions lack equivalency, wherein the method does not comprise evaluating the determined one or more governance requirement rules as each of a plurality of said changes is indicated, but instead comprises evaluating the determined one or more governance requirement rules when a threshold number of changes have been indicated. determining a first propositional logic based at least in part on a first set of security permissions; determining a second propositional logic based at least in part on a second set of security permissions; determining the first propositional logic and the second propositional logic lack equivalency using the first propositional logic and the second propositional logic; and providing an indication that the first set of security permissions and the second set of security permissions lack equivalency, wherein the method does not comprise evaluating the determined one or more governance requirement rules as each of a plurality of said changes is indicated, but instead comprises evaluating the determined one or more governance requirement rules when a threshold number of changes have been indicated.