Frameworks, readiness scoring, drift detection, and the controls simulator — how the Compliance Yoke turns connector results plus attestations into a per-framework score.
Frameworks & readiness
A framework is a named set of categories and controls — the platform ships a curated list (SOC 2-style, HIPAA-style, ISO-27001-style). Each tenant gets the same list; per-control state is tenant-scoped.
A readiness score per framework is a roll-up of category scores. Each category score is computed from:
- Connector results — what GitHub / Fly / WorkOS / AWS observed on the last successful run.
- Evidence — files and attestations sitting in the vault.
- Attestations — explicit operator confirmations for controls that aren't observable via a connector ("we run background checks on new hires").
The score is a number. The platform does not publish "ready / not ready" as a binary — your auditor decides that.
Drift detection
A control's evidence has an expiry window. When the freshest evidence ages past that window, readiness falls without re-running a check. The dashboard surfaces controls whose evidence is about to expire so you can refresh before they drop you below a threshold.
The controls simulator
Before you connect a single source, the simulator lets you model the score. Useful for pre-purchase evaluation — you can see how close you'd be if every control had clean evidence, and where the gap is concentrated.
| Endpoint | What it does |
|---|---|
GET /api/v1/tenant/compliance/simulation | The current simulation state. |
POST /api/v1/tenant/compliance/simulation/start | Begin a new simulation against a framework. |
POST /api/v1/tenant/compliance/simulation/advance | Step forward through the simulator's decision tree. |
The simulator never writes evidence or alters real readiness. It's a read-only "what would the score be if…" surface.
What's not in the framework model today
- Custom frameworks — bring your own controls.
- Custom category mapping — change the weighting of how categories roll up.
- Multi-framework dashboards — a single view that shows every framework's score side-by-side.
See also
- Evidence connectors — the inputs to per-category scoring.
- Auditor Room — what happens at audit time.
- API reference for request and response shapes.