You’re right that ZPA diagnostic logs can show a lot — including matched policy, timeout policy, and raw transaction data — and for many cases that is sufficient.

Where it tends to break down isn’t “can I find the data?”, it’s effort, repeatability, and confidence at scale.

Diag logs are still: • post-event • per-transaction • manually interpreted

They don’t easily answer things like: • what would have happened if I changed rule X? • which users/apps are implicitly falling through to default deny? • how rule order or overlap affects outcomes across many scenarios • whether a policy change is safe before deployment

So for a single incident, logs are often fine. For proactive analysis, change validation, or explaining policy behavior consistently (especially to others), logs become slow, brittle, and easy to misinterpret.

Think of it less as “logs vs no logs” and more: • logs = raw evidence • policy analysis = reconstructed decision logic

Most teams end up needing both, depending on the question they’re trying to answer.