Deterministic by design
The same estate, evaluated twice, produces the same verdict twice. That property is what makes the output defensible.
Why this matters to your auditor
An auditor's first question about any finding is how it was produced. The second is whether it would be produced again. A system that answers differently on different days cannot support either question.
Every rule here is a boolean check against a specific resource property, authored by a person, versioned with an identifier, and mapped to a named framework article. Given the same configuration, it returns the same result, every time, and the record states which rule version produced it.
What the engine is
Expert-authored
Rules are written by people against specific framework articles and controls. They are not generated, inferred, or discovered.
Boolean, not scored
Each check evaluates the actual resource property and returns pass, fail or not assessed. Expected value, actual value, result.
Versioned
Every rule carries a versioned identifier, and every evidence record names the rule version that produced it. A finding from last year can be traced to the exact logic that produced it.
Reproducible
437 rules across five frameworks, evaluated the same way on every scan. No sampling, no ranking, no probability.
What we do not claim
Most platforms in this category describe themselves in terms of capabilities they license rather than build. We take the opposite position, and we state it publicly because our customers are the people who have to explain our output to a regulator.
There is no model inference in the evidence path. No pattern recognition, no probabilistic scoring, no trained model of any kind stands between your Azure configuration and the evidence record produced from it. The path from resource property to audit artifact is arithmetic and boolean logic, and it can be read end to end.
If we ever add capability we did not build, we will say whose it is.
The compliance question underneath
There is a second-order problem with putting a probabilistic system in your compliance path: it becomes another system you have to govern, document and explain. The tool meant to reduce your regulatory surface would increase it.
A deterministic rule engine has no such surface. It is inspectable logic producing an inspectable record.