A control can become invalid when its underlying control query can no longer be evaluated, for example, if the query references an asset type, attribute type, or relation path that no longer exists or can no longer be traversed. When this happens, the control is not executed again until the query is fixed.
The Invalid Query attribute on the Managed Control asset page indicates whether a control's query is currently invalid. For information about this and other system-managed attributes, go to Control Tower operating model.
Note Control Tower Management doesn't proactively flag elsewhere in its interface that a control stopped running, so check the Invalid Query attribute directly to confirm a control's current state. Query drift also isn't detected in every case. For example, a query that references a domain that was later deleted isn't currently flagged as invalid.
Notifications and alerts
When a control becomes invalid, designated recipients receive an actionable alert so they can fix the control before it silently stops evaluating your assets. This capability isn't available yet. It's planned for a later release.