Compliance

Map each obligation to concrete implementation, operational, or approval requirements.

Step 3: Define evidence and checkpoints

State what documentation, test evidence, or approvals must exist before release.

Step 4: Record unresolved risk

If the current plan cannot satisfy the requirement, document the gap, the risk owner, and the escalation path.

Outputs

• compliance-guidance -- the mapped obligations, required controls, evidence expectations, and approval checkpoints

Quality Gate

• Binding obligations are identified with source context
• Required controls are mapped to engineering work
• Release evidence and approval checkpoints are explicit

Anti-Patterns

1. Compliance by slogan -- naming a standard without mapping controls changes nothing.
2. Late legal surprise -- waiting until release review to interpret obligations causes avoidable churn.
3. Evidence after the fact -- if proof is not planned early, it is usually missing when needed.

Related Skills

• requirements-engineering -- captures regulated requirements
• system-design -- maps controls into architecture
• deployment-strategy -- enforces release approvals