Compliance Walkthrough¶

This page traces a single deployment end-to-end: from the persona YAML file, through a workflow run, to an audit bundle, to a one-page brief. We use a deliberately small deployment so every artifact fits in the page.

The example deployment¶

Name: mini-records-triage
Vertical pack: government (6 vertical personas), legal vocabulary (5 personas)
Active personas: 3 (one Finder, one Creator, one Critique)
Workflow graph: 5-node base graph
FCC version: v1.7.0

Step 1: Inspect a persona YAML¶

Here is a condensed version of the Finder persona used:

id: records-finder
category: governance
risk_category: limited
riscear:
  role: "Retrieves applicable statutes and precedent for a records request."
  input: "Structured records request with citizen ID hash, date range, scope."
  style: "Formal, citation-heavy, deterministic."
  constraints:
    - "Only consult corpora listed in data/objectmodel/legal_corpora.yaml."
    - "Never reveal citizen ID hash in output."
  expected_output: "JSON block with statute_ids[], precedent_ids[], confidence."
  archetype: "Knowledge Finder"
  responsibilities:
    - "Detect ambiguity; return confidence < 0.7 if unresolved."
    - "Flag privacy-sensitive terms for the Critique persona."
  role_skills: ["statutory search", "case-law retrieval"]
  role_collaborators: ["records-creator", "records-critique"]
  role_adoption_checklist:
    - "Verify corpus provenance before first use."

Each of the ten R.I.S.C.E.A.R. fields is present. This persona is limited risk. The full deployment's risk is the max of its personas, which we will see is high because the Critique is high.

Step 2: Inspect the Critique persona¶

id: records-critique
category: governance
risk_category: high
riscear:
  role: "Verifies the Creator's draft against redaction rules and citizen-privacy constraints; authorized to halt."
  input: "Draft response + original records request."
  style: "Audit log tone; explicit PASS / HOLD / REJECT verdict."
  constraints:
    - "Must log halt reason in structured form."
    - "May not modify draft; only halt or pass."
  expected_output: "Verdict + rationale + citation to rule."

Note the risk_category: high. The reason is that this persona decides whether a government agency releases a record. That is a high-risk activity under EU AI Act Annex III.

Step 3: Run the audit¶

A technical teammate runs fcc compliance-audit mini-records-triage --regulation=eu_ai_act,nist_ai_rmf --out=bundle/. The bundle contains four files:

bundle/
  report_summary.json        # the ComplianceReport
  evidence_graph.jsonld      # the linked evidence
  findings/                  # one JSON per finding
  model-cards/               # one MD per persona

Step 4: Read the summary¶

{
  "report_id": "audit-mini-records-triage-2026-04-23",
  "risk_classification": "high",
  "summary": {
    "total_requirements": 98,
    "compliant": 91,
    "partial": 5,
    "non_compliant": 1,
    "not_applicable": 1
  }
}

Only 98 requirements are in scope because the vertical pack is government and several EU AI Act articles do not apply to this persona set. The audit engine computes scope automatically.

Step 5: Open the one non-compliant finding¶

{
  "finding_id": "F-mini-001",
  "requirement": "eu_ai_act.art_14.human_oversight",
  "nist_crosswalk": ["govern_1.5", "measure_3.5"],
  "status": "non_compliant",
  "evidence": ["ev_critique_model_card"],
  "remediation": {
    "description": "Critique persona's halt authority is not documented in an adoption ADR.",
    "owner": "records-maintainers",
    "due_date": "2026-05-15"
  }
}

The finding is narrow and closable. It does not say the system lacks human oversight; it says the halt authority is undocumented. The remediation is a one-paragraph addition to the persona's adoption ADR.

Step 6: Inspect the evidence graph¶

A small fragment:

records-critique  --[has_risk_category]--> high
records-critique  --[cited_by]--> F-mini-001
F-mini-001        --[addresses]--> eu_ai_act.art_14.human_oversight
eu_ai_act.art_14  --[crosswalk]--> nist.govern_1.5

This graph is what makes the finding defensible. Any auditor can traverse it and confirm the chain.

Step 7: Produce the one-paragraph brief¶

"The mini-records-triage deployment carries a high risk classification. The 2026-04-23 audit finds 91 of 98 in-scope requirements fully compliant with one material finding — F-mini-001, Article 14 human oversight — closable by documenting the Critique persona's halt authority in an adoption ADR. We recommend conditional approval with remediation due 2026-05-15."

That paragraph is produced directly from the bundle. It references only public-facing concepts. It is defensible.

What just happened¶

You traced the audit from YAML definitions through the CLI, through the evidence graph, into a one-paragraph brief. Each step is deterministic and reproducible: the same inputs plus FCC v1.7.0 produce the same bundle.

Anti-patterns¶

Editing findings manually. The bundle is regenerated. Manual edits are lost; raise a remediation PR instead.
Hiding the risk classification. Never downgrade high-risk to limited-risk to shorten the compliance list. The crosswalk will reveal it.
Counting personas. "164 personas total" is not evidence; "3 personas in this deployment, one of which is high-risk" is.

Where next¶

You have the full loop. Deepen vocabulary in Ecosystem Glossary or branch to regulatory sources in Further Reading. Return to Audit Primer when you have a real bundle in front of you.