Regulation Article → Compliance Rule → Technical Control → Automated Check → Continuous Monitoring
       │                  │                 │                  │                 │
  Human interpretation  Declarative def.  System config     Scheduled exec    Real-time alerting

┌────────────────────────────────────────────────┐
│            Compliance Dashboard                 │
│     (Dashboard + Gap Analysis + Reports)        │
└───────────────────┬────────────────────────────┘
                    │
┌───────────────────▼────────────────────────────┐
│           Compliance Engine                     │
│  ┌──────────────┐  ┌────────────────────────┐  │
│  │ Rule Registry │  │ Check Executor         │  │
│  └──────┬───────┘  └──────────┬─────────────┘  │
│         │                     │                 │
│  ┌──────▼─────────────────────▼─────────────┐  │
│  │         Integration Layer                │  │
│  │  Classification│Access│Masking│Audit│Retn │  │
│  └──────────────────────────────────────────┘  │
└────────────────────────────────────────────────┘

class ComplianceRule(BaseModel):
    """Compliance rule definition"""

    rule_id: str = Field(description="Rule unique identifier")
    regulation: Regulation = Field(description="Parent regulation")
    article: str = Field(description="Regulation article")
    name: str = Field(description="Rule name")
    description: str = Field(description="Rule description")

    check_type: CheckType = Field(description="Check type")
    check_config: dict = Field(description="Check configuration")
    severity: ComplianceSeverity = Field(description="Severity level")
    applies_to: ApplicabilityFilter = Field(description="Applicability scope")
    remediation: str = Field(default="", description="Remediation guidance")

    enabled: bool = Field(default=True)
    last_updated: datetime = Field(default_factory=datetime.utcnow)


class Regulation(str, Enum):
    GDPR = "gdpr"
    HIPAA = "hipaa"
    PCI_DSS = "pci_dss"
    SOX = "sox"
    PIPL = "pipl"

class CheckType(str, Enum):
    CLASSIFICATION_CHECK = "classification_check"
    ACCESS_CONTROL_CHECK = "access_control_check"
    MASKING_CHECK = "masking_check"
    AUDIT_CHECK = "audit_check"
    RETENTION_CHECK = "retention_check"
    ENCRYPTION_CHECK = "encryption_check"
    CONSENT_CHECK = "consent_check"

class ComplianceSeverity(str, Enum):
    CRITICAL = "critical"
    HIGH = "high"
    MEDIUM = "medium"
    LOW = "low"
    INFO = "info"

GDPR_RULES = [
    ComplianceRule(
        rule_id="gdpr-001",
        regulation=Regulation.GDPR,
        article="Article 5(1)(c)",
        name="Data Minimization",
        description="Personal data must be limited to what is necessary for the processing purpose",
        check_type=CheckType.CLASSIFICATION_CHECK,
        check_config={
            "require_classification": True,
            "require_purpose_tag": True,
            "max_retention_without_purpose": 365,
        },
        severity=ComplianceSeverity.HIGH,
        remediation="Add classification labels and purpose descriptions to all PII fields",
    ),
    ComplianceRule(
        rule_id="gdpr-002",
        regulation=Regulation.GDPR,
        article="Article 17",
        name="Right to Erasure",
        description="Must be able to delete all personal data of a data subject",
        check_type=CheckType.ACCESS_CONTROL_CHECK,
        check_config={
            "require_deletion_capability": True,
            "data_categories": ["pii"],
            "max_deletion_time_hours": 72,
        },
        severity=ComplianceSeverity.CRITICAL,
        remediation="Ensure all PII data supports API-based deletion within 72 hours",
    ),
    ComplianceRule(
        rule_id="gdpr-003",
        regulation=Regulation.GDPR,
        article="Article 30",
        name="Records of Processing",
        description="Must maintain records of processing activities",
        check_type=CheckType.AUDIT_CHECK,
        check_config={
            "require_audit_trail": True,
            "event_types": ["data_access", "data_modification"],
            "min_retention_days": 365,
        },
        severity=ComplianceSeverity.HIGH,
        remediation="Enable audit trails for data access and modification, retain for 1+ year",
    ),
    ComplianceRule(
        rule_id="gdpr-004",
        regulation=Regulation.GDPR,
        article="Article 32",
        name="Security of Processing",
        description="Personal data must be encrypted at rest and in transit",
        check_type=CheckType.ENCRYPTION_CHECK,
        check_config={
            "require_encryption_at_rest": True,
            "require_encryption_in_transit": True,
            "min_classification": "B2",
        },
        severity=ComplianceSeverity.HIGH,
        remediation="Enable encryption at rest and in transit for B2+ classified data",
    ),
]

HIPAA_RULES = [
    ComplianceRule(
        rule_id="hipaa-001",
        regulation=Regulation.HIPAA,
        article="164.312(a)(1)",
        name="Access Control",
        description="PHI must have access control mechanisms",
        check_type=CheckType.ACCESS_CONTROL_CHECK,
        check_config={
            "data_categories": ["phi"],
            "require_rbac": True,
            "require_abac": True,
            "min_classification": "C1",
        },
        severity=ComplianceSeverity.CRITICAL,
    ),
    ComplianceRule(
        rule_id="hipaa-002",
        regulation=Regulation.HIPAA,
        article="164.312(b)",
        name="Audit Controls",
        description="PHI access must have audit records",
        check_type=CheckType.AUDIT_CHECK,
        check_config={
            "data_categories": ["phi"],
            "require_detailed_audit": True,
            "min_retention_days": 2190,  # 6 years
        },
        severity=ComplianceSeverity.CRITICAL,
    ),
    ComplianceRule(
        rule_id="hipaa-003",
        regulation=Regulation.HIPAA,
        article="164.312(e)(1)",
        name="Transmission Security",
        description="PHI in transit must be encrypted",
        check_type=CheckType.ENCRYPTION_CHECK,
        check_config={
            "data_categories": ["phi"],
            "require_tls": True,
            "min_tls_version": "1.2",
        },
        severity=ComplianceSeverity.CRITICAL,
    ),
]

class ComplianceCheckExecutor:
    """Compliance check executor"""

    def __init__(self):
        self._checkers: dict[CheckType, ComplianceChecker] = {
            CheckType.CLASSIFICATION_CHECK: ClassificationChecker(),
            CheckType.ACCESS_CONTROL_CHECK: AccessControlChecker(),
            CheckType.MASKING_CHECK: MaskingChecker(),
            CheckType.AUDIT_CHECK: AuditChecker(),
            CheckType.RETENTION_CHECK: RetentionChecker(),
            CheckType.ENCRYPTION_CHECK: EncryptionChecker(),
            CheckType.CONSENT_CHECK: ConsentChecker(),
        }

    async def run_check(self, rule: ComplianceRule, scope: CheckScope) -> CheckResult:
        checker = self._checkers[rule.check_type]
        findings = await checker.check(rule.check_config, scope)

        return CheckResult(
            rule_id=rule.rule_id,
            regulation=rule.regulation,
            status=CheckStatus.PASS if not findings else CheckStatus.FAIL,
            findings=findings,
            checked_at=datetime.utcnow(),
            scope=scope,
        )

    async def run_full_assessment(
        self, regulation: Regulation | None = None,
    ) -> ComplianceAssessment:
        rules = self._get_applicable_rules(regulation)
        results = []

        for rule in rules:
            if not rule.enabled:
                continue
            scope = self._determine_scope(rule)
            result = await self.run_check(rule, scope)
            results.append(result)

        return ComplianceAssessment(
            regulation=regulation,
            total_rules=len(results),
            passed=sum(1 for r in results if r.status == CheckStatus.PASS),
            failed=sum(1 for r in results if r.status == CheckStatus.FAIL),
            results=results,
            assessed_at=datetime.utcnow(),
            compliance_score=self._calculate_score(results),
        )

class ClassificationChecker(ComplianceChecker):
    """Data classification compliance checker"""

    async def check(self, config: dict, scope: CheckScope) -> list[ComplianceFinding]:
        findings = []

        for asset in await self._catalog.list_assets(scope=scope):
            for prop in asset.technical.properties:
                if config.get("require_classification") and not prop.classification:
                    findings.append(ComplianceFinding(
                        severity=ComplianceSeverity.HIGH,
                        asset_id=asset.asset_id,
                        field_name=prop.name,
                        finding="Field missing data classification label",
                        remediation="Add a classification label to this field",
                    ))

                min_level = config.get("min_classification")
                if min_level and prop.classification:
                    if prop.classification.level.code < min_level:
                        findings.append(ComplianceFinding(
                            severity=ComplianceSeverity.MEDIUM,
                            asset_id=asset.asset_id,
                            field_name=prop.name,
                            finding=f"Classification {prop.classification.level.code} below required {min_level}",
                            remediation=f"Upgrade classification to {min_level} or above",
                        ))

        return findings

class GapAnalyzer:
    """Compliance gap analysis engine"""

    async def analyze_gaps(self, target_regulation: Regulation) -> GapAnalysisReport:
        assessment = await self._executor.run_full_assessment(target_regulation)

        gaps = []
        for result in assessment.results:
            if result.status == CheckStatus.FAIL:
                rule = self._rule_registry.get(result.rule_id)
                gaps.append(ComplianceGap(
                    rule=rule,
                    findings=result.findings,
                    estimated_effort=self._estimate_effort(rule, result.findings),
                    priority=self._calculate_priority(rule, result.findings),
                ))

        gaps.sort(key=lambda g: g.priority, reverse=True)

        return GapAnalysisReport(
            regulation=target_regulation,
            compliance_score=assessment.compliance_score,
            total_gaps=len(gaps),
            critical_gaps=sum(1 for g in gaps if g.rule.severity == ComplianceSeverity.CRITICAL),
            gaps=gaps,
            remediation_plan=self._generate_plan(gaps),
        )

class ComplianceReportGenerator:
    """Compliance report generator"""

    async def generate_report(
        self, regulation: Regulation, period: DateRange,
        report_type: ReportType = ReportType.FULL,
    ) -> ComplianceReport:
        assessment = await self._executor.run_full_assessment(regulation)
        audit_summary = await self._audit_service.get_summary(period)
        gap_analysis = await self._gap_analyzer.analyze_gaps(regulation)

        return ComplianceReport(
            regulation=regulation,
            period=period,
            generated_at=datetime.utcnow(),
            executive_summary=self._build_executive_summary(assessment, gap_analysis),
            compliance_score=assessment.compliance_score,
            assessment_details=assessment,
            gap_analysis=gap_analysis,
            audit_summary=audit_summary,
            recommendations=self._generate_recommendations(gap_analysis),
        )

class ComplianceMonitor:
    """Continuous compliance monitoring"""

    SCHEDULE = {
        ComplianceSeverity.CRITICAL: timedelta(hours=1),
        ComplianceSeverity.HIGH: timedelta(hours=6),
        ComplianceSeverity.MEDIUM: timedelta(days=1),
        ComplianceSeverity.LOW: timedelta(days=7),
    }

    async def run_continuous_monitoring(self) -> None:
        while True:
            for severity, interval in self.SCHEDULE.items():
                rules = self._get_rules_by_severity(severity)
                for rule in rules:
                    if self._is_due(rule, interval):
                        result = await self._executor.run_check(rule, CheckScope.FULL)
                        if result.status == CheckStatus.FAIL:
                            await self._alert_service.send_alert(
                                ComplianceAlert(
                                    rule=rule, findings=result.findings, severity=severity,
                                ),
                            )
            await asyncio.sleep(300)

class TestComplianceEngine:
    async def test_gdpr_classification_check(self):
        executor = ComplianceCheckExecutor()
        result = await executor.run_check(GDPR_RULES[0], CheckScope.FULL)
        assert result.status in (CheckStatus.PASS, CheckStatus.FAIL)

    async def test_hipaa_audit_check(self):
        executor = ComplianceCheckExecutor()
        result = await executor.run_check(HIPAA_RULES[1], CheckScope.FULL)
        if result.status == CheckStatus.FAIL:
            assert len(result.findings) > 0
            assert all(f.remediation for f in result.findings)

    async def test_gap_analysis(self):
        analyzer = GapAnalyzer(executor, rule_registry)
        report = await analyzer.analyze_gaps(Regulation.GDPR)
        assert 0.0 <= report.compliance_score <= 1.0

    async def test_report_generation(self):
        generator = ComplianceReportGenerator(executor, audit_service)
        report = await generator.generate_report(
            Regulation.GDPR,
            DateRange(start=datetime(2024, 1, 1), end=datetime(2024, 12, 31)),
        )
        assert report.executive_summary
        assert report.compliance_score is not None