Scorecards
Write the standard. Score every service.
A standard nobody measures is a preference. Scorecards check your resources against rules you define and give each a maturity level you can argue about with evidence.
Maturity distribution
Levels and rules
Gold means everything below it passed too
A scorecard turns your standards into rules, sits each rule at a level, and hands a resource a level only when every rule at that level and below it passes. There’s no numeric score, on purpose. A level is a rank, so a service failing basic hygiene can’t flash Gold on a couple of advanced passes. The rules themselves read from three places.
Scorecards come with the Advanced and Enterprise plans.
Resource properties
Anything on the resource, whatever put it there: a form input, a deployment output, an API call. Has a code owner. Deployed in the last thirty days.
Plugin records
A computed aggregation over a plugin’s data, or a direct query when a rule needs one: open critical PRs over thirty days old, or whether branch protection is on for the default branch.
Inventory metrics
Coverage from your asset inventory, so a rule can demand a team’s IaC coverage stays above a line, or that nothing in it is left unmanaged.
Cycloid for your team
What scorecards change for your team
Name the eleven, not the document
The problem
You publish standards and have no idea which services meet them, so enforcement turns into nagging.
With Cycloid
Rules over properties, plugin records and inventory coverage, re-checked when a property changes, on a daily pass, and on demand.
The outcome
You can name the eleven services below Silver instead of resending the document.
A list, in the order that helps
The problem
You are told your service is non-compliant and left to work out which part, and by when.
With Cycloid
The scorecard on your resource page shows every rule with its outcome and the level it belongs to, skipped and exempted ones included.
The outcome
You fix the two rules that move you a level, not the twenty that do not.
Is it actually getting better?
The problem
Maturity is anecdotal, so the readiness conversation goes to whoever is most persuasive in the room.
With Cycloid
A distribution across levels, a trend over twelve months with definition changes marked, and a breakdown by team.
The outcome
You can see whether the standard is met, and whether that is improving.
How it works
From a checklist to a measured standard
01 · Write the rules
Property comparisons, boolean logic, aggregation. Rules are parsed on save, so a typo is caught then, not six weeks later.
02 · Put each at a level
Basic, Bronze, Silver, Gold by default, and you can rename them. The ladder is cumulative, so a level means what it says.
03 · Cycloid evaluates
On every relevant change, on a daily baseline pass, and on demand. You don’t schedule anything.
04 · Read the result
Each resource shows its level and the exact rules it failed. You fix the two that move you up.
05 · Exempt where it's fair
A legacy box gets an exemption with a reason and an optional expiry, shown as exempted, never as a pass.
Two notes ride along with that. A failing rule notifies the owners and names the missing item, and the owner fixes it with a Day-2 action or a property update; the next check picks it up. (Rest of paragraph unchanged.) And a Gold built on last week’s data isn’t Gold, so you decide whether stale data warns, fails the rule, or drops out of the maths.
From a checklist to a measured standard
The short version
Scorecards in numbers
4
levels by default. Rename them
4
outcomes a rule can have, exemptions too
3
re-checks: on change, daily, on demand
12mo
of history, so you can see progress
Which services are below Silver?
Eleven, and nine of them fail the same rule. Two more are held at Bronze for different reasons.
Scorecard · Production readiness
Read as you
Common failure
No runbook URL, 9 services
Other
1 exempted, 1 skipped on stale data
Working with your assistant
Which services are below the line, and what's missing
Does the assistant get its own permissions?
No. There’s no service account and no elevated assistant role. If you can’t deploy to production, neither can the assistant you’re talking to, in Cycloid’s own assistant or any compliant MCP host.
Ask which services sit below Silver and the assistant reads the scorecard results as you, under your permissions, and hands back the resources and the rules they failed. It’s a read, so there’s nothing to approve. It’s the report you’d have built from the dashboard yourself.
And it stops where the product stops. The assistant can tell you eleven services are missing a runbook URL. It doesn’t change anything for you: it names the services and their owners, and each owner fixes it with a Day-2 action or a property update.
Frequently asked questions
How is a level earned?
Level by level. A resource reaches a level when every rule at that level and below it passes. Exemptions count as passes, and a skipped rule simply drops out of the maths. It’s a rank, not a score.
What happens when plugin data goes stale?
You choose, rule by rule. Warn uses the cached figure and flags how old it is. Fail treats stale data as a failing rule. Skip drops the rule for now and shows you the reason it was skipped.
Do scorecards auto-fix issues?
No. They compute levels, surface what’s missing and notify the owners. Each owner fixes it with a Day-2 action or a property update, and the next check picks it up. (HTML + schema)
Bring the standard nobody follows
Twenty minutes, the readiness checklist from your last incident review, and the rules it becomes. Then we run it across your resources and show you the distribution, which is usually a more interesting conversation than the checklist ever was.