5.4 — Regulatory Compliance as an Architecture Constraint

CCAR-P Domain 5 · Task 5.4

What You Need to Know

An obligation becomes an architecture constraint when it changes what you build. Scope is the whole data path, not the application.

Scope: Every Hop

• Request to model provider
• Retrieval index and embeddings
• Prompt and response logs
• Observability traces
• Evaluation datasets
• Analytics/monitoring vendors and their subprocessors

Traces and eval sets are the most commonly forgotten copies.

Minimise at the Boundary

Send only the fields the task needs. Redact, tokenise or pseudonymise before crossing a trust boundary; keep the re-identification key inside. De-identification of training/eval data may also be required depending on risk.

Agreements Precede the Data Flow

Have the contract before the data moves. HIPAA BACs require: permitted uses, safeguards, breach reporting, subcontractor flow-down, and return-or-destroy at termination (or continued protection of what cannot be returned).

Purpose, Retention, Residency, Rights

Purpose and retention are design inputs for every copy. Data-subject rights (access, correction, deletion, portability) require finding every copy — vector indexes, traces, and eval fixtures are where deletion requests miss.

FedRAMP

A FedRAMP authorisation certifies the service completed the process; it is not an authorisation to operate. The agency’s authorising official still decides. Choose services already authorised at the required impact level, or keep the component inside the boundary the official will authorise.

Key Concept: When a stem describes too much data crossing a boundary, sort options by what still crosses afterwards. Only one changes that number.

Exam Traps

• Adding privacy notice/encryption/shorter retention/access limits while the same fields keep crossing
• Drawing the assessment around the user-facing application while logs/traces/indexes/eval sets sit outside
• Putting the processor agreement in place at the vendor’s next contract renewal
• Treating a supplier’s FedRAMP authorisation as the agency’s own ATO