Evaluation Log
The results of evaluating a control's assessment requirements.
Role
Evaluation is measurement: did this instance of a sensitive activity satisfy the assessment requirements cited by a policy plan? The log records targets, control requirement ids, plan ids, pass/fail results and messages.
It is evidence of inspection—not the policy itself and not yet the enforcement action.
Examples
Failed secret scan on internal-tools PR #417
A company-moderated pull request is evaluated against the FOSS contribution policy. IP review passes with a recorded legal disposition; the data-leakage secret scan fails when an uncleared AWS access key is found. The evaluation log captures both results against named control requirements and assessment plans.
Source: internal-tools PR #417 Evaluation Log (foss-eval-internal-tools-pr417).
Passed evaluation on commons-lang PR #482
A company-interest contribution clears the same per-contribution plans—showing that evaluation is routine exhaust for successful paths, not only failure packs.
Source: commons-lang PR #482 Evaluation Log (foss-eval-commons-lang-pr482).
Links upstream
Links downstream
- Enforcement Log justified by failed (or cleared) evaluations
- Audit Log cites evaluation evidence
Anti-patterns
Evaluation without a cited plan
Ad-hoc scanner output that cannot point at a policy assessment plan or control requirement. Auditors cannot replay intent.
Only logging failures
Passing evaluations discarded. Continuous governance and audit then lack the positive evidence trail.