Control evidence mapping

Step 01

Define and Align

Review representative examples and annotate the fields that need to change. Explain the edge cases to teach your team’s policy.

Output schema

CoverageChoose one: How well the supplied evidence supports the requested control and period.
supported
partial
not_supported
GapsList of values: Missing or mismatched evidence; empty when all requirements are supported.
ExplanationText: Evidence-grounded reason for the coverage label.

app.sutro.sh/functions/control-evidence-mapping

Collecting feedback · 1/3

Assess whether the supplied evidence supports the requested control for the requested period.

Example 1 of 3

Signed review for the wrong period

Model input

Control: Synthetic internal control AC-4: Production privileged access must be reviewed quarterly. Evidence must show the production scope, the completed review date within the requested quarter, and reviewer sign-off. A procedure describes intent; it does not prove execution. Judge only the supplied evidence.
Requested period: Q3 2026 (July–September)
Evidence: Production privileged-access review completed June 25, 2026. Reviewer sign-off: Security lead.

Model output

Coverage

GapsMultiple values

Explanation

Why? Optional guidance

Step 02

Model Sweep

Compare models on the same expert annotations, then choose a quality–cost tradeoff.

Compare models on expert agreement and cost. The interactive chart uses illustrative measurements.

Illustrative sweep · select Value or Best to use that model in your function.

Step 03

Deployment

Call Sutro Functions like any other software. Swap the model as soon as something more performant is released.

Selected modelWaiting for sweep results.

Real-time

import sutro as so

input_data = {
    "control": "Synthetic internal control AC-4: Production privileged access must be reviewed quarterly. Evidence must show the production scope, the completed review date within the requested quarter, and reviewer sign-off. A procedure describes intent; it does not prove execution. Judge only the supplied evidence.",
    "requested_period": "Q3 2026 (July–September)",
    "evidence": "Production privileged-access review completed June 25, 2026. Reviewer sign-off: Security lead."
}

result = so.run_function(
    "control-evidence-mapping",
    input_data,
)

curl --fail-with-body -X POST "${SUTRO_API_URL%/}/v1/functions/control-evidence-mapping/run" \
  -H "Authorization: Key $SUTRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "input": {
    "control": "Synthetic internal control AC-4: Production privileged access must be reviewed quarterly. Evidence must show the production scope, the completed review date within the requested quarter, and reviewer sign-off. A procedure describes intent; it does not prove execution. Judge only the supplied evidence.",
    "requested_period": "Q3 2026 (July–September)",
    "evidence": "Production privileged-access review completed June 25, 2026. Reviewer sign-off: Security lead."
  }
}'

Batch

import sutro as so

job_id = so.batch_run_function(
    name="control-evidence-mapping",
    data="control_evidence_mapping.csv",
)
results = so.await_job_completion(job_id)

curl --fail-with-body -X POST "${SUTRO_API_URL%/}/v1/batch-inference" \
  -H "Authorization: Key $SUTRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "model": "control-evidence-mapping",
  "inputs": [
    {
      "control": "Synthetic internal control AC-4: Production privileged access must be reviewed quarterly. Evidence must show the production scope, the completed review date within the requested quarter, and reviewer sign-off. A procedure describes intent; it does not prove execution. Judge only the supplied evidence.",
      "requested_period": "Q3 2026 (July–September)",
      "evidence": "Production privileged-access review completed June 25, 2026. Reviewer sign-off: Security lead."
    }
  ]
}'