Executive briefSyntactically valid code can implement the opposite duty

A retention policy says records must be deleted after a period unless a legal hold applies. Generated policy code parses, compiles and passes its happy-path test. Yet the implementation treats “legal-hold status unavailable” as false and deletes protected records. Every syntactic check is green; the norm has been reversed at the most important boundary.

Policy becomes an operational control only through interpretation, fact design, placement, implementation, verification, release and change management. The output may be code, configuration, a workflow obligation, a monitoring rule, a human determination, a release gate, a recovery procedure or a supplier clause. Treating code as the only serious output pushes contextual duties into unsuitable machinery.

The Policy Compilation Chain proposed here has eleven governed stages. Each stage emits an attributable artefact, unresolved items and links to its inputs. A six-class Compilation Loss Register records what disappeared or changed during translation. Policy diff impact analysis then carries a changed source or interpretation through fact contracts, controls, tests, releases, historical decisions and supplier obligations.

Compilation does not confer authority to interpret law. Legal and policy owners approve applicability, meaning, assumptions and reserved judgement. Models may help locate clauses, compare text or propose tests, but their output is a draft. Production behaviour rests on accountable decisions and evidence, not fluent extraction.

The strongest rival: retain expert interpretation

For low-volume, ambiguous or rapidly changing decisions, a trained expert using a structured workflow can be safer and cheaper than detailed automation. Compilation adds synchronisation, testing and maintenance debt and may freeze a disputed reading. The correct result can therefore be a bounded human workflow. When the policy lacks definitions, a reliable fact contract or an authorised decision rule, the correct result is to return it to its owner as not decision-ready.

Policy Compilation ChainEleven stages preserve authority from source to release

Stage gates need exit conditions. Source freeze ends only when the text and referenced definitions can be reproduced. Applicability ends when included and excluded cases have owners. Interpretation ends when assumptions and reserved questions are signed. Fact design ends when missing, stale and conflicting states have explicit meanings. Verification ends when observed effects match the approved norm across the corpus. Release ends only when deployed versions, enforcement acknowledgements and rollback limits are observable. Moving an unresolved item forward is allowed only with a named destination and a release-blocking status; a backlog label does not resolve semantic debt.

Separation of duties protects meaning without paralysing delivery. A policy owner should not attest that code behaves correctly merely because the text was interpreted correctly. An engineer should not decide that an omitted exception is immaterial. A fact steward should not approve the business norm simply because the field is available. The compilation receipt therefore collects distinct assertions from interpretation, data, control, release and assurance owners. Smaller organisations can combine roles, but the assertions and conflicts remain separate.

Semantic frameA clause must say who owes what, under which conditions

Norm extraction comes before rule writing. A permission allows an act; it does not require it. A prohibition blocks an act. An obligation requires action, while a recommendation signals preferred practice without the same force. Definitions change the meaning of later clauses. Exceptions narrow or defeat a general norm under stated authority. Reserved judgement identifies a determination that must remain with a named human.

The semantic frame expands a candidate clause into subject, action, object, conditions, purpose, threshold, time, authority, evidence and consequence. It retains references to defined terms and other clauses. For a deletion obligation, the subject may be the records service, the action deletion, the object a defined record class, the condition expiry without a valid hold, and the evidence a deletion receipt tied to the applicable policy version.

Temporal semantics need particular care. Publication, effective, event, evaluation and action times may differ. A new rule can govern new admissions while old decisions complete under a prior version. A retroactive obligation may require historical replay, while another change must never rewrite the evidence of what was valid at decision time. The interpretation record decides these questions before implementation.

Representation standards can help without settling meaning. LegalRuleML 1.0 represents legal sources, norms, provenance and temporal features. ODRL 2.2 models permissions, prohibitions, duties, constraints, parties and assets. DMN 1.5 represents decision requirements, input data and decision logic. None supplies authoritative applicability or legal interpretation; each expresses decisions already made by accountable owners.

Fact contractUnknown is not false, and stale is not current

A policy decision consumes facts whose authority must be explicit. The contract names field, type, source, principal, provenance, event time, effective time, validation, freshness, permitted purpose and treatment of missing or conflicting values. JSON Schema Draft 2020-12 can validate structural assertions; OpenAPI 3.2.0 can describe service operations and errors. Neither proves that the value is true or authorised for this purpose.

Use at least five fact states: true, false, unknown, stale and unavailable. Unknown means the authoritative answer is not established. Stale means an answer exists but its effective-time condition has expired. Unavailable means the source cannot be consulted. A broad deny may be appropriate for a fast, severe action when a critical entitlement is unavailable; it can be unjustified for a benefit process where missing data requires inquiry or human consideration.

Fact derivation must remain visible. A model classification of purpose or sensitivity is estimated evidence, not an authoritative identity or entitlement. The contract records uncertainty and corroboration. When facts conflict, the control returns a typed indeterminate result and routes it to the named owner rather than relying on evaluation order.

Control pattern and placementChoose the effect that can still change the governed outcome

Preventive controls stop prohibited admission, release or action. Directive controls require a process, evidence item or approved method. Detective controls find violations or emerging patterns. Corrective controls repair specific records or decisions. Recovery controls restore service and reconcile effects. Human-authority controls reserve a determination. Contractual controls create supplier duties, notice, audit or remedy that internal code cannot enforce alone.

One policy may compile into several patterns. A supplier notification obligation becomes a contract clause, monitored deadline, escalation workflow and evidence receipt. A model-release policy becomes evaluation requirements, a release gate, signed artefact and rollback procedure. The policy-to-control relationship is many-to-many, so lineage must not imply that one rule “covers” the clause.

Directive and detective patterns are frequently confused. A requirement to review a consequential decision before commitment is directive and needs workflow authority; an alert showing that review did not happen is detective and arrives too late for prevention. Corrective and recovery patterns also differ. Correcting one customer record does not reconcile a failed service, while restoring service does not correct every decision produced during the fault. The compiler names the protected outcome and selects complementary patterns rather than relabelling one dashboard as several controls.

Contractual controls need operational interfaces. A supplier promise to notify within a period becomes an event or monitored communication channel, an authoritative clock, an acknowledgement, escalation ownership and evidence retention. If the supplier uses a portal that no system or person watches, the clause exists but the effect is absent. Procurement owns the obligation's legal form; operations owns readiness to receive and act; assurance verifies the join.

Placement follows the last reliable point before protection is lost: design, release, admission, context assembly, routing, tool invocation, external commitment, monitoring or recovery. A prompt may guide generation but cannot prevent data already assembled into context from crossing a boundary. A detective alert may support correction but cannot substitute for pre-commitment authority where harm is immediate.

Risk classification from Paper 102 is an input to control intensity, not recreated here. Higher consequence or weaker recovery can demand independence, stronger test corpus, narrower exposure and human authority. Compilation decides how the accepted obligation operates at that intensity.

Compilation Loss RegisterSix error classes make semantic drift reviewable

Scope loss drops an actor, population, geography, jurisdiction or lifecycle stage. Norm loss turns duty into advice, permission into mandate or recommendation into prohibition. Fact loss removes required context, time, provenance or unknown states. Exception loss omits a lawful exception or broadens it beyond authority. Effect loss produces a result that does not change the governed outcome. Evidence loss prevents later reconstruction of source, interpretation, test, version and enforcement.

The register records source fragment, compiled representation, observed difference, affected scenarios, materiality, disposition and owner. Loss may be accepted when representation is deliberately narrower and the residual case is handled elsewhere. Material loss is never hidden inside a comment or implementation ticket; it blocks release until the interpretation owner accepts a controlled alternative.

Loss can also arise through composition. Two individually correct controls may conflict when one redacts the fact another requires, when regional routing happens after a global denial, or when cached policy versions evaluate the same transaction differently. Composition tests follow the full production order and confirm which obligation has precedence, which facts remain available and which receipt explains the combined result. The loss register links the conflict to both sources rather than assigning it to the component that happened to fail last.

A language model can accelerate comparison, but it cannot approve the semantic diff. Require reviewers to inspect high-risk transformations and generated tests against source text and definitions. The most revealing example is code that passes syntax and expected positives while implementing the wrong deontic force. A generated “allow if approved” rule may silently become “approve if allowed”, confusing a policy condition with business authority.

Generated code deserves the same treatment as any untrusted change. A model can propose a rule, schema or test, but the proposal is labelled with its source material, prompt context and review status. Reviewers compare its semantic frame and counter-cases with the authorised interpretation. Generated tests cannot independently validate generated policy when both share the same mistaken summary. At least one verification path must originate from the frozen source and an accountable reviewer.

Verification corpusTest meaning at boundaries, conflicts and failure states

Positive cases confirm that eligible activity receives the intended permission or fulfilment. Negative cases prove that prohibited or inapplicable activity does not pass. Boundary cases exercise thresholds, effective times, jurisdictions and population edges. Exception cases prove exact eligibility, approval, duration and unaffected controls. Conflict cases expose precedence or indeterminate outcomes.

Stale-fact cases distinguish expired evidence from falsehood. Outage cases exercise unavailable policy, identity and fact services. Adversarial cases attempt bypass, misleading labels, replay, parameter substitution and version downgrade. Include syntactically valid but semantically wrong variants as mutation tests. The corpus is organised around governed outcomes, not clause count.

Verification has several layers. Schema tests establish structural conformance. Policy-unit tests evaluate rules against facts. Integration tests prove the enforcement point applies the result. Workflow and recovery tests prove obligations, approval, correction and rollback. Independent semantic review compares observed outcomes with source and interpretation. Passing a parser proves only the first layer.

Build cases from equivalence classes and policy boundaries rather than enumerating convenient examples. Vary actor role, purpose, object class, jurisdiction, event time, effective time and exception state independently. Exercise absent and contradictory facts. For every allow, identify the fact whose change should deny, transform, require approval or return indeterminate. For every denial, include a lawful case that must pass. This paired design exposes broad deny rules and silent mandates that positive-only testing rewards.

Test the action acknowledgement separately from the decision result. A policy engine may correctly return deny while an application ignores the response on timeout. A workflow may collect approval after a tool has already committed. A deletion job may report success without removing replicas or derived indexes. The verification receipt links evaluated facts, result, enforcement point and actual downstream state, while respecting privacy and evidence-minimisation requirements.

NIST SSDF 1.1 and SLSA 1.2 support disciplined development and provenance of artefacts. OSCAL can structure control implementation and assessment information. PROV-O can link source, interpretation, artefact, activity and agent. Integrity is important, but a perfectly signed control may still encode the wrong norm.

Policy diff impactA changed clause must find every dependent decision and obligation

Source or interpretation change begins with a semantic diff: added, removed or changed definitions, scope, norm, condition, exception, authority and effective time. Text similarity is not enough. A one-word change from “may” to “must” can be operationally larger than a rewritten paragraph.

Lineage traverses from the changed clause to semantic frames, fact contracts, policy rules, schemas, workflows, release gates, monitoring, supplier clauses, tests and deployed versions. It also identifies decisions made under the old interpretation and in-flight work crossing the effective boundary. Owners decide migration, replay, notification, grandfathering and evidence retention.

No production update proceeds while conflicting enforcement points run incompatible versions without an explicit transition. Stage the new artefacts, dual-evaluate where lawful, compare results, preserve old receipts, activate at the approved time and retain a rollback that does not resurrect a superseded prohibited behaviour. Rollback can target implementation failure; it cannot overrule a newly effective authoritative norm.

Historical impact is a separate decision. A corrected interpretation may apply only prospectively, require reopening past outcomes or demand notification without replay. The policy owner and authorised legal function decide that scope; engineers do not infer it from a database migration. The lineage graph supplies affected populations, decision versions and evidence availability so the owner can choose. The release plan then preserves original receipts and adds linked correction records instead of overwriting what the system did.

Emergency changes still use the chain, with narrower time and stronger after-action duties. Freeze the authoritative instruction, identify the principal, scope the temporary effect, use a pre-approved safe pattern, capture unresolved loss and set an expiry. After containment, complete semantic review and corpus testing before converting the emergency artefact into a normal release. An urgent ticket is not permanent interpretive authority.

The release receipt records source and interpretation versions, loss dispositions, fact contracts, artefact digests, corpus result, affected services, effective time, migration, rollback limit, monitoring and owners. Retirement removes obsolete rules and credentials while preserving reconstructable history.

Ten compilation casesThe output is selected by norm, facts, consequence and judgement

Each case completes the chain at a useful level of detail. The table highlights the norm, principal artefact, decisive test, likely loss and change trigger. The full compilation receipt retains source, frame, facts, owners and lineage.

Interactive instrumentPolicy-to-Control Compile Bench

Select a case or change the compilation inputs. The Bench returns exactly one of five outcomes and exposes missing terms, fact states, loss, tests, lineage and accountable owners. It does not provide legal interpretation or a clause-coverage score.

Operating boundaryCompile decisions, not institutional authority

The Policy Compilation Chain, Compilation Loss Register, policy diff impact analysis and Compile Bench are this article's synthesis. NIST AI RMF and Playbook provide governance context. SP 800-53 and OSCAL support control and assessment structures. SSDF and SLSA support development and artefact integrity. They do not decide the meaning of an enterprise obligation.

OPA, Cedar and XACML demonstrate declarative policy and access-control patterns. LegalRuleML, ODRL and DMN offer limited semantic representations. OpenAPI 3.2.0 and JSON Schema Draft 2020-12 describe interfaces and structured fact contracts. PROV-O can express lineage. No representation or policy language supplies authoritative legal interpretation, factual truth, correct placement or legitimate business permission.

Operate compilation as a joint cadence. Policy and legal owners freeze sources and approve interpretations. Product and risk owners define decisions and consequence. Data stewards warrant fact sources. Architects and control owners choose patterns. Engineers implement. Operations exercises failure and rollback. Assurance challenges semantic correctness, lineage and observed effect. A named release owner accepts only resolved loss.

The cadence needs queues and service expectations because policy change competes with product change. Maintain an intake for new sources, interpretation questions, fact gaps, loss dispositions and revalidation. Prioritise by effective time, consequence, population and current control exposure rather than clause count. Publish the controls awaiting a decision and the production versions affected. This makes delay visible without pressuring engineers to invent missing policy.

Metrics should describe the compilation system without becoming a maturity score. Useful views include unresolved material loss, controls running after source expiry, conflicting deployed versions, stale fact contracts, corpus failures, unacknowledged effects, exceptions nearing expiry, decisions awaiting historical-treatment instructions and time from approved interpretation to verified release. Each measure retains its owner and consequence; favourable throughput cannot compensate for a materially wrong norm.

Review on source, definition, interpretation, jurisdiction, actor, population, fact authority, model, workflow, provider, placement, exception or outcome change. Current records checked on 2 September 2026 include LegalRuleML 1.0, ODRL 2.2, DMN 1.5, OpenAPI 3.2.0, JSON Schema Draft 2020-12, NIST SSDF 1.1 and SLSA 1.2.

The standard is not the percentage of clauses “covered”. It is whether every material governed outcome has an approved meaning, a trustworthy fact contract, a control that changes the path in time, counter-case evidence, visible semantic loss and reconstructable change lineage. Where that cannot be achieved, retain accountable human interpretation or return the policy for a decision-ready revision.

Source recordWorks cited

1. NIST. Artificial Intelligence Risk Management Framework.
2. NIST. AI RMF Playbook.
3. NIST. Open Security Controls Assessment Language.
4. NIST. SP 800-53 Rev. 5.
5. NIST. SP 800-218 SSDF 1.1.
6. ISO. ISO/IEC 42001.
7. European Union. Regulation (EU) 2024/1689.
8. Open Policy Agent. Policy Language.
9. Cedar. Documentation.
10. OASIS. XACML 3.0 Core Specification.
11. OASIS. LegalRuleML Core Specification Version 1.0.
12. W3C. ODRL Information Model 2.2.
13. Object Management Group. Decision Model and Notation 1.5.
14. OpenAPI Initiative. OpenAPI Specification.
15. JSON Schema. Draft 2020-12.
16. W3C. PROV-O.
17. SLSA. Specification 1.2.