SOC 2 · Evidence
What your auditor gets
A record for every change that your reviewer can inspect without trusting the agent’s prose.
A full receipt for one control
Example workflow: a terminated employee still holds access in GitHub and AWS.
dx_01K7A2R9QH4T6MZXW3NB8CJ5KD
Desired state: t.lindqvist: Workspace suspended, GitHub membership removed, AWS key inactive and admin unassigned
Changes · 4
- Google WorkspaceAccount statusBefore → after
Active → SuspendedAuthorized byOffboarding policyTime14:07:13 - GitHubOrganization membershipBefore → after
Owner → RemovedAuthorized byOffboarding policyTime14:07:15 - AWSAccess key …Q7XFBefore → after
Active → InactiveAuthorized byOffboarding policyTime14:07:18 - AWSAdministratorAccess on prodBefore → after
Assigned → UnassignedAuthorized bym.chen, SecurityTime14:07:22
Not run · 1
- GitHubDelete the accountWhyUsed in the last 180 days · sent to Security
Approval
m.chen, Security · 14:07:12“Termination confirmed in the HR system”
Read back · 5
- GitHubOrganization membershipObservedNot a memberTime14:07:51
- AWSAccess key statusObservedInactiveTime14:07:56
- AWSPermission set assignmentsObservedNone, on the second readTime14:08:37The first read did not match: admin still assigned, job remains open.
- HR, WorkspaceAccount statusObservedTerminated, suspendedTime14:08:41
- PlatformCC6.2 test re-runObservedPassingTime14:08:44
What every record carries
Each governed action writes these fields, and each one answers a question an auditor asks.
| Field | Recorded | Why an auditor cares |
|---|
| Actor | Who acted, and on whose behalf | The auditor sees whether a person, a policy, or an agent made the change. |
|---|
| Resource | The exact resource it touched | A sample can be traced to one account, key, or role. |
|---|
| Policy | The policy that allowed it | It shows the change was inside authority your company wrote down. |
|---|
| Approval | The approver, their reason, and the time | Sensitive changes name a person who answered for them. |
|---|
| State | The state before and after | It shows what the control looked like before the fix and after. |
|---|
| Read-back | The read-back that confirmed it | It confirms the system holds the new state, so the agent’s summary is not the evidence. |
|---|
| Signature | A signature, and a link to the previous record | The history is append-only, so an edit after the fact is detectable. |
|---|
Exports
Evidence reports leave Deixic in the format your reviewer already reads.
- PDFA formatted report to hand over as a document.
- HTMLThe same report to read in a browser.
- JSONThe raw record for your own tooling or a reviewer’s script.
- Checked at exportEach export is checked against the underlying record before it is released.
- ScheduledGenerate reports daily, weekly, or monthly.
How an auditor samples it
Take one terminated employee and follow the receipt to the read-back.
- 01Pick t.lindqvist from your HR list of terminated employees. The termination date is Sep 26.
- 02Open receipt dx_01K7A2R9QH4T6MZXW3NB8CJ5KD, filed under CC6.2.
- 03For each change, read the resource, the state before and after, and who authorized it: the offboarding policy or a named approver.
- 04Check the approval: m.chen, Security, reason given, time 14:07:12. The change it covers ran at 14:07:18, after it.
- 05Find the read-back for each change. Each one comes after its change and names what the system returned.
- 06Check the refused action. The account deletion did not run and went to Security.
- 07Confirm the signature and the link to the previous record, then compare the PDF, HTML, or JSON export with the record.
For your own agents
Claude Code and Codex read the same records over MCP.
Ask over MCP
- Who still has production admin?
- What changed for CC6.2 last quarter?