Compliance
Compliance maps controls to frameworks, tests each from the records every Action leaves, and publishes the trust center buyers read.
A Startup inherits its controls, so it sells as compliant from its first day.
Summary
| Part | This System |
|---|---|
| Group | Trust and governance |
| Status | Beta: it works, and its Verbs may still change |
| Shelf | Wakes: offered once its Event fires |
You can ask:
- “Show me our SOC 2 status”
- “Answer this security questionnaire”
- “What risks are open?”
- “Publish a trust page”
What you get
| Part | This System |
|---|---|
| Starts | On for every Startup at creation, with nothing to install. |
| Wakes | On Deal.advanced when the buyer asks for a SOC 2 report or a security questionnaire. |
| Built from | Audit log, Event streams, Functions, Workflows |
Nouns it owns
| Noun | Definition |
|---|---|
| Control | A Control is a rule the platform enforces on every write it covers, with a test that runs over the whole population. |
| Criterion | A Criterion is one requirement of an outside framework, such as SOC 2 or GDPR, that one or more Controls satisfy. |
| Proof | A Proof is the sealed result of one Control test: the Events it read, the root it checked them against, and every exception. |
| Audit | An Audit is one engagement with an outside firm: the namespaces in scope, the Criteria, the report period, and the firm’s Attestation. |
| Risk | A Risk is something that could harm a Startup or a Portfolio, scored by likelihood and impact, and treated, accepted, or closed. |
Verbs
| Verb | Object | Approval | Event |
|---|---|---|---|
| Risk.assess | Risk | None | Risk.assessed |
| Risk.treat | Risk | None | Risk.treated |
| Risk.accept | Risk | Asks first; waits 1 business hour | Risk.accepted |
| Risk.close | Risk | Asks first; waits 1 business hour | Risk.closed |
Events
| Direction | Event | How |
|---|---|---|
| Emits | Risk.assessed | By Risk.assess |
| Emits | Risk.treated | By Risk.treat |
| Emits | Risk.accepted | By Risk.accept |
| Emits | Risk.closed | By Risk.close |
States
None.
Who operates it
| Part | This System |
|---|---|
| Accountable | Compliance Officer |
| Team | Legal Team |
| Seat | A role agent holds it until a Human is seated. |
| Autonomy | assist |
| Also calls its Verbs | Founder, Risk Analyst |
Approvals and limits
| Verb | Rule | Detail |
|---|---|---|
| Risk.accept | A person says yes first | Waits 1 business hour |
| Risk.close | A person says yes first | Waits 1 business hour |
Processes that use it
| Process | How it uses it |
|---|---|
| Procure | A step calls Risk.assess |
| Upstream review | A step calls Risk.assess |
| Risk assessment | A step calls Risk.assess |
Rail underneath
None.
Views and dashboards
| View | Shows | Metrics |
|---|---|---|
| The Compliance Officer’s view | The Metrics its accountable Role answers for. | Intakes answered on time |
Access
What each Access level may call here.
| Access level | May call |
|---|---|
owner | Every Verb (16) |
admin | All but 2 of 16: Risk.accept, Risk.close |
member | All but 2 of 16: Risk.accept, Risk.close |
viewer | Read only (10 of 16) |
Import and export
None.
Fees and pricing
None.
Availability and limits
| Part | This System |
|---|---|
| Status | Beta: it works, and its Verbs may still change |
Compliance notes
Controls it carries:
- Governance oversight
- Action accountability
- Risk assessment
- Control wake review
- Control definition
- Inherited floors
- Policy approval
- System description
- Trust status
- Log completeness
- Continuous control testing
- Control sameness
- Adversarial control testing
- Deviation closure
- Append-only records
- Revert by query
- Action completion
- Disclosure record
Related Systems
Example
A b2b Headless SaaS for HR data receives a 180-question security questionnaire from a buyer. The trust center answers 171 from tested controls. The Compliance Officer Agent answers the other nine and links each answer to its Evidence.