# Compliance

URL: /workflows/processes/compliance · Id: `process:compliance`

> Compliance proves every control holds, from the records the platform keeps as work happens.

Compliance proves every control holds, from [Evidence](/business/nouns/evidence) the platform records as work happens.

## Outcome
| Part | This Process |
| --- | --- |
| Outcome | Every Control has a current passing result, or an open Issue for its failure. |
| Reads | [Control](/business/nouns/control) |
| Leaves | [Issue](/business/nouns/issue) |
| Runs in | Each Startup |

## Accountable
[Legal Lead](/agents/legal/legal-lead), [Legal Team](/agents/legal).

## Workflows
| Workflow | Runs | Team |
| --- | --- | --- |
| [Control testing](/workflows/processes/compliance/evidence-collection) | every day | [Legal Team](/agents/legal) |

## Who does each step

| Workflow | Step | Role | Calls | Approval |
| --- | --- | --- | --- | --- |
| [Control testing](/workflows/processes/compliance/evidence-collection) | 1. Query the records for each Control’s test. | [Compliance Officer](/agents/legal/compliance-officer) | [Collection.query](/business/nouns/collection/query) | None |
| [Control testing](/workflows/processes/compliance/evidence-collection) | 2. Record each result as Evidence against the published root. | [Compliance Officer](/agents/legal/compliance-officer) | [Evidence.create](/business/nouns/evidence/create) | None |
| [Control testing](/workflows/processes/compliance/evidence-collection) | 3. Open an Issue for every Control without a current passing result. | [Compliance Officer](/agents/legal/compliance-officer) | [Issue.create](/business/nouns/issue/create) | None |

## Events
| Direction | When | What happens |
| --- | --- | --- |
| In | Every day | Starts [Control testing](/workflows/processes/compliance/evidence-collection) |
| Out | [`Collection.queried`](/business/events/Collection.queried) | Raised by step 1 of [Control testing](/workflows/processes/compliance/evidence-collection) |
| Out | `Evidence.created` | Raised by step 2 of [Control testing](/workflows/processes/compliance/evidence-collection) |
| Out | `Issue.created` | Raised by step 3 of [Control testing](/workflows/processes/compliance/evidence-collection) |

## Plays
No Play names this Process.

## Controls
- [Governance oversight](/systems/trust-and-governance/controls/governance-oversight)
- [Risk assessment](/systems/trust-and-governance/controls/risk-assessment)
- [Control wake review](/systems/trust-and-governance/controls/control-wake-review)
- [Control definition](/systems/trust-and-governance/controls/control-definition)
- [Inherited floors](/systems/trust-and-governance/controls/inherited-floors)
- [Policy approval](/systems/trust-and-governance/controls/policy-approval)
- [System description](/systems/trust-and-governance/controls/system-description)
- [Trust status](/systems/trust-and-governance/controls/trust-status)
- [Log completeness](/systems/trust-and-governance/controls/log-completeness)
- [Continuous control testing](/systems/trust-and-governance/controls/continuous-testing)
- [Control sameness](/systems/trust-and-governance/controls/control-sameness)
- [Deviation closure](/systems/trust-and-governance/controls/deviation-closure)
- [Health data agreements](/systems/trust-and-governance/controls/health-data-agreements)

## Settings
None.

## Failure
A failed step retries; when retries run out, the Action goes to the [Legal Lead](/agents/legal/legal-lead).

## Loop
No loop: the path is never randomized, because it serves [Continuous control testing](/systems/trust-and-governance/controls/continuous-testing).

## Code

**Ask**

```text
Turn on compliance
```

**API**

```bash
curl -X POST https://api.sb/leaseline.app/processes/process_1/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_1' })
```

**CLI**

```bash
npx startup-builder do Process.enable --json '{"process":"process_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Process.enable({ process: 'process_1' })"
  }
}
```

## Enable
On by default for every Product Template. [Process.pause](/business/nouns/process/pause) stops new Actions; Actions in progress finish.

## Example
A payroll-data API has 214 controls in scope, 190 of them inherited from its [Studio](/business/nouns/studio). [Control testing](/workflows/processes/compliance/evidence-collection) runs every night. It finds one control with no Evidence for last week and opens an [Issue](/business/nouns/issue), closed the next morning.