← Compliance as Infrastructure Reference Specification
The Specification

Compliance as Infrastructure

Compliance touches every system. Yet in most organizations it lives nowhere. Pieces of it are scattered across the ERP, the PLM, the CRM, spreadsheets, emails, and the minds of compliance officers. The Compliance Infrastructure Layer gives compliance a place to live: regulatory meaning embedded in operational objects, enforced by the systems that execute transactions, and proven by evidence generated at the moment of every decision.

The pages below define the five core concepts of that architecture. Each page is canonical: the definition, the normative rules, the conformance requirements, and the diagnostic question. The founding text is Compliance as Infrastructure by Gloria Gallo, where the full argument, the design method, and the domain playbooks are developed.

Where the layer sits
Where the compliance infrastructure layer sits Existing enterprise systems feed events through connectors into the compliance infrastructure layer, which returns decisions and evidence. Compliance officers exchange exceptions and determinations with the layer. SYSTEMS OF RECORD THE WORK HAPPENS HERE · COMPLIANCE DOES NOT LIVE HERE PLM · JIRA PRODUCTS · ECOS CRM CUSTOMERS · PARTIES ERP ORDERS · SHIPMENTS SCREENING APIS CSL · PROVIDERS CONNECTORS · TRANSLATE SYSTEM ACTIVITY INTO COMPLIANCE EVENTS ECO RELEASED · CUSTOMER CREATED · ORDER BOOKED · SHIPMENT REQUESTED · LIST UPDATED COMPLIANCE EVENTS IN DECISIONS · EVIDENCE OUT The Compliance Infrastructure Layer WHERE COMPLIANCE LIVES CONTROL DNA REGULATORY IDENTITY GATE ENGINE PASS OR BLOCK · DETERMINISTIC REGISTERS ARCHITECTURAL MEMORY EVIDENCE FABRIC HASH-LINKED · GENERATED, NEVER ASSEMBLED INTELLIGENCE HUB EMERGING RISK · RECURRING EXCEPTIONS · LICENSE DRIFT · COUNTRY DRIFT · SUPPLIER BEHAVIOR OBSERVES EVERYTHING · SURFACES SIGNALS · NEVER DECIDES EXCEPTIONS DETERMINATIONS COMPLIANCE OFFICERS JUDGMENT · DOCUMENTED · ATTRIBUTED COMPLIANCE TOUCHES EVERY SYSTEM · IT LIVES IN ONLY ONE PLACE
Concept 01
Control DNA
Control DNA is the structured regulatory identity of a controlled item or transaction: the complete set of regulatory attributes, embedded at object formation, that travels with the object through every system that touches it.
Read the specification →
Concept 02
Architecture Precedence
Architecture Precedence is the structural law that regulatory data must exist inside operational systems before enforcement is possible. Data, then gates, then evidence, then visibility. Design before control.
Read the specification →
Concept 03
The Intelligence Layer
The Intelligence Layer is the probabilistic observation stratum of the compliance architecture. It reads behavior across time, context, and relationships, and surfaces signals the deterministic architecture cannot resolve. It informs. It does not decide.
Read the specification →
Concept 04
Enforcement Gates
An Enforcement Gate is a system condition placed at a control surface that cannot be bypassed. The system evaluates the object's Control DNA against applicable regulatory conditions and determines whether the transaction proceeds or stops. The evaluation is the proof.
Read the specification →
Concept 05
Versioned Evidence
Versioned Evidence is the immutable record generated automatically at the moment of every compliance decision: the object, the actor, the regulatory condition, and the timestamp. Records are supplemented by new versions. No silent overwrite is allowed. Ever.
Read the specification →

The layers of the discipline

Specification
The five concepts
The canonical definitions on this page. Everything else in the discipline is built from these.
Applied layer
The five domains
The architecture applied where export exposure forms: gates, registers, and monitoring signals per operational domain.
Instruments
Tools & proof
Working instruments built on the specification, including the complete five-domain system running live.
Founding text
The book
The executive case, the architecture, the design method, and the operational playbook. The full treatment.