Compliance Results
Every completed design is scored against your applicable controls, control by control, with a stated outcome and a reason. This is the difference between "we believe it is compliant" and "control by control, here is where it stands": the matrix is generated, current, and re-generated every time the design or the rules change.
Read the Matrix
Each control shows one of four outcomes:
| Outcome | Meaning |
|---|---|
| Pass | The design satisfies the control, with the reasoning stated |
| Fail | The design does not satisfy it; the reason names what is missing or wrong |
| Review | The platform cannot decide alone; a human needs to look |
| Not Applicable | The control does not apply to this design |
The summary chips (pass / fail / review counts) follow the package everywhere: the Architecture card, the Review & Approval evidence panel, and the exported SSP.
How the Checks Work
Two kinds of evidence feed the outcomes:
- Deterministic checks examine the design's structure directly: flows carrying sensitive data classes are held to encryption expectations, storage components to at-rest posture, boundary crossings to their protections.
- Stated-knowledge checks use what the design itself asserts: encryption at rest and in transit is recorded per component and flow as encrypted, cleartext, or unknown; unknown is never counted as compliant, so anything the model could not confidently assert lands in front of the architect rather than passing silently.
When Results Refresh
Results re-evaluate whenever the design changes: a re-run, an architect edit, or the Re-evaluate button. They also refresh when the rules change: updating the control catalog marks affected packages and re-evaluates them, so a rule change ripples to every design it touches.
When a Control Fails
Three legitimate paths out:
- Let the loop fix it: Remediate Findings feeds the failing controls back into another design pass (Run the Automated Design).
- Fix it yourself: edit the design and re-evaluate.
- Accept it deliberately: a design carrying failing controls can still be approved, but only through Risk Sign-off; never by default.
Results Become Evidence
At approval, the control results are snapshotted into the package's evidence, and drift detection watches for regressions against exactly that snapshot afterward.