How assessments combine observed evidence and attestations, how scope affects results, and why readiness is not certification.
SOC 2 readiness
Compliance evaluates the organization against the product's versioned SOC 2
control catalog. It is a readiness and evidence tool, not a certification or an auditor's opinion.
The screen is available only when the organization's plan includes the capability and the member has
view-compliance; the built-in auditor role is limited to this evidence surface.
Readiness
An assessment runs in the background over the declared scope. It reads facts xAuto can observe from tracked infrastructure and platform activity, and keeps those results separate from facts a named person must attest to. The screen intentionally shows two figures:
Observed from infrastructure for provider and platform evidence.
Satisfied by attestation for policies and practices the platform cannot infer.
There is no combined score. Combining the two would imply that a cloud configuration and a person's statement carry the same kind of evidence. If coverage is too thin, the screen reports that instead of turning missing evidence into a misleading zero.
Every catalog control remains visible, including controls the platform cannot assess. Open one to see its verdict, reason, affected entities, missing reads, evidence and remediation. An unreadable connection is reported as a gap and does not silently disappear from the assessment.
Scope
The Scope tab declares which projects, environment names and resource categories are examined. An unset dimension means all current and future values, not an empty set. Organization-level controls are assessed regardless of the project boundary because the organization itself is the subject of those controls.
Scope declarations are append-only, effective-dated evidence. Changing the scope does not rewrite an old assessment or immediately change its numbers; run a new assessment to apply the new boundary. Until then, Readiness warns that the displayed verdicts belong to the previous scope.
History and evidence
History lists each on-demand or scheduled assessment, the catalog version, outcome and verdict counts. A past result keeps the scope and catalog version it was produced under, so later policy or catalog changes do not silently rewrite evidence.
Attestations should name what is in force and who is responsible. They complement observed evidence; they do not turn something the platform could not read into an observed pass.