Palo Alto Strata Cloud Manager (SCM): address/tag/group config objects plus a Best Practice Assessment (BPA) runner (run_bpa) over the Posture API, with a human-readable BPA report.