Compliance

What it is

Continuous regulatory posture management. Assess a project against frameworks (DORA, CRA, PLD, NIST CSF, ISO 27001, SOC 2, GDPR, HIPAA, NIS2, EU AI Act, and more), track gaps, manage incidents and SBOM / vulnerabilities, and generate evidence dossiers. A standing Compliance agent sweeps this posture autonomously.

Operator surface

  • Assessment & reporting — compliance_status, compliance_assess (re-evaluate frameworks and persist scores + gaps), compliance_assessment_history, compliance_requirements, compliance_gaps / compliance_gap_create, compliance_frameworks, compliance_mappings, compliance_market_readiness.
  • Catalogue customization — compliance_catalogue_list plus control / requirement create, override, disable, and clear-override tools.
  • Incidents — incident_create, incident_classify, incident_timeline_submit, incident_close, incident_overdue.
  • Supply chain — sbom_latest, sbom_import, vulnerability_list / vulnerability_record, compliance_documents / compliance_document_upload.

REST lives in ComplianceController, ComplianceCatalogueController, IncidentController, RegulatoryDossierController, and DossierController.

How it works

The requirement / control catalog and cross-framework control mappings live in the control plane (ComplianceRequirements, ComplianceControls, ComplianceControlMappings) and are resolved per tenant with overrides. Assessments persist as ComplianceAssessmentRunRecord → ComplianceAssessmentItemRecord rows with ComplianceGapRecord and ComplianceEvidenceRecord. Assessment can invoke LLM-driven rule checks under the Compliance:Assessment site preset.

Catalogue changes proposed by the Compliance agent (compliance_catalogue_propose_delta) never write the catalog directly: each delta lands in the Decisions queue as a ratification request that a different human must approve — the proposer can never be the approver. On approval the delta is applied to the governing catalog and every dossier that depends on it is flagged stale; re-rendering a stale dossier stays an explicit human action.

Incidents, SBOM snapshots / components, third-party providers, dossier entries, and report snapshots are all tenant-scoped and feed exportable, optionally bilingual (EN / FR) compliance reports and dossiers. The same control catalog backs the Workflows compliance overlay (materialize / waivers / publish floor).