Appearance
Scope Registry
Where to find it: Regulatory Compliance, then Scope Registry (/scope-registry).
A Declared Scope (SCP-YYYY-NNNN) is an explicitly stated boundary: what a compliance conclusion applies to.
Scope before assurance
An assurance conclusion — evidence coverage, control effectiveness, requirement satisfaction, risk posture — is only legitimate, meaningful and auditable when evaluated against an explicitly declared and historically reproducible scope boundary.
This is the founding doctrine of the module, and it is worth being concrete about why.
"MFA is enforced" is not a compliance statement. "MFA is enforced across the 214 privileged accounts declared in scope SCP-2026-0012 as at 31 March" is. The first cannot be verified, challenged or reproduced. The second can be all three.
Two kinds of scope
| Type | Denominator | Use for |
|---|---|---|
population | The count of effective-dated members at the evaluation instant | Anything with a countable population: systems, accounts, employees, contracts |
qualitative | 1 | Governance facts: a board approval, an annual policy review, a legal entity boundary |
Qualitative scopes exist so nothing has to be faked
An annual board risk appetite review has no population. Forcing it into a percentage produces a meaningless number.
A qualitative scope evaluates the honest question: does a valid, current observation exist? Coverage is 100% or 0%, and neither is a fabrication.
What a scope carries
| Field | Purpose |
|---|---|
| Business reference | SCP-YYYY-NNNN, immutable |
| Name and description | What boundary this is |
| Purpose | assessment, control_baseline, audit, regulatory_filing, certification, policy_boundary |
| Scope type | population or qualitative |
| Target type | asset, business_service, third_party, department, policy, process, governance, mixed |
| Population category | Applications, servers, endpoints, cloud subscriptions, accounts, privileged users, employees, contractors |
| Expected count | The denominator, for qualitative scopes |
| Owner | Who is accountable for the boundary being correct |
| Status | active or archived |
Members and effective dating
Scope members are the subjects inside the boundary. Members can be assets, business services, third parties, departments, policies or processes — linked as what they are, never duplicated.
Each membership carries:
| Field | Meaning |
|---|---|
valid_from | When the subject entered the scope |
valid_until | When it left; unset while current |
added_by / removed_by | Who made each change |
| Notes | Why |
Membership is never destructively deleted
Removing a subject sets valid_until. The membership row remains.
This is what makes historical assurance reproducible. Without it, asking "how many systems were in scope in March?" would return today's answer, and every historical compliance figure would silently change every time the scope moved.
Historical reconstruction
A subject is in a scope at instant T when valid_from is at or before T, and valid_until is unset or after T.
Worked reconstruction:
| Time | Event | As of that time | As of January |
|---|---|---|---|
| January | 5 systems declared in scope | 5 systems | 5 systems |
| June | A sixth system added | 6 systems | Still 5 |
| August | A legacy system removed | 5 systems | Still 5 |
Querying as of January returns January's answer in August, in the following year, and in an audit three years later.
Any scope can be reconstructed as of any date through the reconstruct view.
Linking scopes to what they govern
Scopes link to requirements, controls and business services. Those links are what let an indicator know its denominator, and what let a framework adoption know its boundary.
Declaring a scope well
Name it for the boundary, not for the project. "Payments Platform Production" survives the project that created it. "ISO Certification 2026" does not.
One boundary per scope. A scope containing production systems and corporate laptops has one denominator and two populations, and every coverage figure computed from it will be a blend of two unrelated things.
Set the population category deliberately. It is what tells a reader what the denominator counts.
Record why members were added and removed. The note field is the only place that reasoning will exist in two years.
Review membership on a cadence. A scope nobody has touched in eighteen months is more likely stale than stable.
Permissions
| Action | Permission |
|---|---|
| View assets, scopes and historical membership | scope.read |
| Create and edit assets, declare scopes, manage effective-dated membership, link scopes | scope.manage |
The Scope Registry is core infrastructure — non-licensable and available across tiers.
Example
Scope `SCP-2026-0007 — Payments Platform Production.
| Field | Value |
|---|---|
| Purpose | certification |
| Type | population |
| Target type | mixed |
| Population category | Applications and servers |
| Owner | Head of Payments Technology |
| Current members | 63 |
Membership over the year:
| Date | Change | Members after |
|---|---|---|
| 1 Jan | 58 systems declared at scope creation | 58 |
| 14 Mar | 5 systems added following a platform expansion | 63 |
| 2 Jul | 3 legacy systems removed on decommissioning | 60 |
| 18 Sep | 3 systems added for a new payment rail | 63 |
Why it matters: the certification assessment was performed in April. Reconstructing the scope as of the assessment date returns 63 members — not today's 63, which is a coincidentally identical but differently composed population.
The Statement of Applicability produced for that assessment, and every coverage figure in it, resolves against April's membership.
Troubleshooting
"Coverage denominators look wrong." Check scope membership as of the evaluation instant rather than today.
"A removed subject still counts." The valid_until date is later than the evaluation instant, which is correct if the subject was in scope then.
"I want to delete a scope." Archive it. Scopes are not deleted; the assurance conclusions computed against them need the boundary to remain reconstructable.
"Assets I decommissioned still show in scope." Decommissioning and scope removal are separate acts. End the membership.