Designing route explanations that survive a SOC 2 audit
The router's score is one number; the explanation is what a reviewer reads. We walk through how Mission Control composes 'Acme chosen — certified provider, verification pass rate 94%, fast (p95 1200ms)' and why it matters more than the score itself.
Paste a manifest into the public demo or bring a scoped workflow to the private beta.
What an SOC 2 reviewer wants to see
Not the score. The reasons. A reviewer asks 'why did your system pick this vendor?' — and 'because score=0.83' is not an answer. 'Because the vendor is certified, has a 94% verification pass rate over the last 30 days, p95 latency is 1.2s vs 4.5s for the cheaper alternative, and the price is competitive ($0.10 vs $0.04 cheaper alternative)' is an answer.
Mission Control composes the explanation from the same inputs the score uses. Every reason corresponds to an input that's tracked, hashable, and reproducible.
Patterns that work
Always name the chosen vendor. Always enumerate at least 1 alternative considered. Always give exact reasons ("verification pass rate 94%") not adjectives ("high verification"). Always include the cost diff vs cheapest peer. Always include p95 latency. Always say whether the vendor is certified.
The pattern is: list the wins; quantify them; call out the alternative; let the reader cross-check.
Related reading
- Signed Security Receipts for AI Agents— A signed security receipt turns an agent safety check into portable evidence: subject hash, policy hash, decision, findings, evidence hash, issuer, and verifier identity.
- The audit trail is the product— Why a hash-chained ledger turns 'we ran a workflow' into 'we paid for a verified outcome with proof' — and why that's the actual value of governance software.