Compliance & Governance

compliance/
├── risk-assessment.md
├── regulatory-map.yaml
└── validation-schedule.yaml

compliance:
  risk_tier: high                        # low | standard | high | critical
  frameworks: [finra, federal_reserve]   # finra | federal_reserve | sec | cfpb

  supervision:
    designated_supervisor: "jane.doe@example.com"
    review_cadence: "monthly"
    human_in_the_loop: "always"          # always | conditional | advisory | none
    override_capability: true
    kill_switch: true

  recordkeeping:
    audit_logging: true
    log_format: "json"
    retention_period: "7y"              # e.g. "6y", "3y"
    immutable: true

  model_risk:                           # Federal Reserve SR 11-7
    inventory_id: "MRM-0042"
    validation_cadence: "quarterly"
    ongoing_monitoring: true
    outcomes_analysis: true
    drift_detection: true
    parallel_testing: false

  data_governance:                      # CFPB, Reg S-P
    pii_handling: "redact"              # redact | anonymize | allow
    data_classification: "confidential"
    consent_required: true
    cross_border: false
    bias_testing: true
    lda_search: true                    # fair lending / lending discrimination analysis

  communications:                       # FINRA 2210
    type: "retail"
    pre_review_required: true
    fair_balanced: true
    no_misleading: true
    disclosures_required: true

  vendor_management:                    # SR 23-4
    due_diligence_complete: true
    soc_report_required: true
    vendor_ai_notification: true
    subcontractor_assessment: true

  segregation_of_duties:
    roles:
      - id: maker
        description: "Initiates transactions"
        permissions: [read, propose]
      - id: checker
        description: "Reviews and approves"
        permissions: [read, approve]
    conflicts:
      - [maker, checker]
    enforcement: "strict"

  financial_governance:
    spending:
      max_per_transaction_cents: 10000  # max spend per transaction (in cents)
      max_monthly_cents: 100000
    approval:
      require_above_cents: 5000         # require human sign-off above this
      timeout_minutes: 30
      auto_deny_on_timeout: true
    firewall: "stripe-radar"            # named identifier e.g. stripe-radar, local-script

opengap audit
# Compliance Audit Report
# Agent: my-agent v1.0.0
# ─────────────────────
# 1. Risk Classification
#    Risk Tier: HIGH
#
# 2. Supervision (FINRA Rule 3110)
#    ✅ Designated supervisor assigned
#    ✅ Review cadence defined
#    ✅ Human-in-the-loop configured
#    ✅ Kill switch enabled
#
# 3. Recordkeeping (FINRA Rule 4511 / SEC 17a-4)
#    ✅ Audit logging enabled
#    ⚠️  Retention period not defined
#
# 4. Model Risk Management (SR 11-7)
#    ✅ Model inventory ID assigned
#    ⚠️  validation_cadence not set