---
name: architect-compliance
description: >
  Maps a deployed instance to the regulatory regimes named in Q9 (GDPR, CCPA, HIPAA, SOC 2,
  ISO 27001, FedRAMP, PCI-DSS). Produces per-regime obligation tables, identifies gaps in L2
  philosophy and L3 framework contract, scaffolds compliance-evidence runbooks, and pairs
  with the validate skill on annual control-test cycles. Triggered when the operator says:
  "compliance audit", "GDPR mapping", "SOC 2 control evidence", "what does HIPAA require us
  to do", "regulatory mapping", "compliance gap", "FedRAMP compliance", "annual audit prep".
  Refuses to declare compliance posture without a named owner per regime.
---

# architect-compliance

Maps deployed instance to regulatory regimes; produces per-regime obligation tables; identifies L2/L3 gaps; scaffolds evidence runbooks. Pairs with validate on audit cycles.

## When to invoke

- Operator says: "compliance audit", "GDPR mapping", "SOC 2 control evidence", "regulatory mapping", "compliance gap", "annual audit prep", "what does HIPAA require us to do", "FedRAMP compliance"
- Q9 of the localization set returned regimes that need mapping
- Annual control-test cycle approaches
- New regulatory regime applies (jurisdiction expansion, customer-driven audit demand, regulatory change)

## Operating modes

### Mode A: Initial regime mapping (run once per regime)

For each regime named in Q9:

1. Identify which sections of the regime apply to this function:
   - **GDPR:** Art. 6 (lawful basis), Art. 7 (consent), Art. 13-14 (transparency), Art. 17 (right to erasure), Art. 25 (privacy by design), Art. 32 (security), Art. 35 (DPIA), Art. 44+ (international transfer)
   - **CCPA:** disclosure, right to delete, right to opt-out, non-discrimination
   - **HIPAA:** Privacy Rule, Security Rule (Administrative, Physical, Technical safeguards), Breach Notification
   - **SOC 2:** Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy); CC controls; SOC 2 Type II requires sustained evidence over period
   - **ISO 27001:** ISMS controls (Annex A); risk assessment; statement of applicability
   - **FedRAMP:** Low / Moderate / High baseline controls (NIST 800-53)
   - **PCI-DSS:** 12 requirements; scope dependent on cardholder data flow
2. Per applicable section, produce an obligation row:
   - Regime + section
   - Obligation in plain language
   - Where this instance addresses it (artifact + line reference)
   - Gap if any
3. Output a per-regime table in `{instance_root}/cross-platform/compliance-{regime}.md`

### Mode B: Gap remediation

For each gap surfaced in Mode A:

1. Classify the gap:
   - **L2 philosophy gap:** the red lines or PII rule do not address the obligation
   - **L3 framework contract gap:** the technical contract does not implement the obligation
   - **L7 cross-platform gap:** a cross-cutting concern (e.g., consent flow) is missing or incomplete
   - **Evidence gap:** the control exists but evidence is not captured for audit
2. Recommend the remediation path:
   - L2 gap -> revise `policies/philosophy.md` and write an ADR if the change is material
   - L3 gap -> revise `policies/framework-contract.md`; bump pinned versions; re-eval
   - L7 gap -> add or extend the relevant cross-platform artifact
   - Evidence gap -> scaffold a runbook in `runbooks/{regime}-control-evidence.md`
3. Add the remediation to BACKLOG with a closes-by date driven by the audit cycle

### Mode C: Annual control-test evidence capture

For each regime requiring sustained evidence (notably SOC 2 Type II):

1. Read the runbook `runbooks/{regime}-control-evidence.md`
2. For each named control, capture evidence per the runbook's procedure:
   - Telemetry queries
   - Sample artifacts
   - Drill results (e.g., cross-tenant isolation drill for SOC 2 CC6)
   - Incident response logs
3. Produce the annual control-evidence package; file location per regime conventions
4. Notify Compliance Engineering pod via outbox

### Mode D: Regulatory change response

When a regime changes (new article, updated baseline, court ruling that reinterprets):

1. Read the change against the existing regime mapping
2. Identify which obligations changed
3. Run Mode A for changed sections (refresh the obligation table)
4. Run Mode B for any new gaps
5. Schedule re-audit if the change is material

## Refusal conditions

The skill refuses to declare compliance posture if:

- The regime has no named owner on this instance (a role or person responsible for the regime's controls)
- The L2 philosophy artifact is `none` or `stubbed` (compliance posture cannot be derived from a missing philosophy)
- The L3 framework contract is `none` or `stubbed` (controls cannot be implemented without a contract)

In any refusal case, surface the precondition the operator must address before compliance mapping can be meaningful.

## Per-regime owner naming

Every active regime needs a named owner inside the org (not "the team"). Typical owners:

- GDPR: Data Protection Officer + Compliance Engineering
- CCPA: Privacy Office + Compliance Engineering
- HIPAA: HIPAA Privacy Officer + Security Officer
- SOC 2: Security Office + Compliance Engineering
- ISO 27001: ISO Lead + Internal Audit
- FedRAMP: FedRAMP Lead + Federal Security Officer
- PCI-DSS: PCI Compliance Officer + Payment Security

If the org does not have these roles named, the regime's compliance posture is `unknown` and surfaces as a finding for the operator to escalate.

## Cross-references inside the kit

- `BOOTSTRAP-BRIEF.md` Section X (audit standard) and Section XII (observability)
- `QUESTIONS.md` Q9 (compliance and tooling stack)
- `templates/L2-philosophy.md` - compliance posture section
- `templates/L3-framework-contract.md` - telemetry schema for audit trail
- `examples/martech-mature-instance/policies/philosophy.md` - reference example with GDPR + SOC 2 mapping
- `examples/martech-mature-instance/cross-platform/consent-flow.md` - reference example of GDPR Art. 7 + 17 enforcement
- `skills/architect-adr/SKILL.md` - paired when compliance gap remediation requires a decision
- `skills/validate/SKILL.md` - paired during annual control-test evidence cycle
