Compliance means meeting applicable legal, regulatory, contractual, or organizational requirements. In access control, it becomes a practical question: who may access protected data, what actions are allowed, when access is appropriate, and what evidence proves the rule was followed. section 1.3.4 section 14.5
Compliance-driven authorization commonly requires:
- Context-sensitive access, such as limiting a nurse to patients under her care while on duty. section 1.3.4
- Least privilege, such as giving a financial analyst reports without access to underlying raw data. section 1.3.4
- Policies combining requester attributes, data attributes, purpose, relationship, or consent. section 1.3.4 section 14.5
- Auditable evidence connecting requirements to policy versions, approvals, tests, runtime decisions, and review records. section 14.5
From obligation to evidence
When auditors question access to personal or financial data, coordinators can produce the relevant policy, its ADR justification, approval history, validation results, and production decision logs. Metadata tags such as sox:access-review or gdpr:data-access help connect deployed policies to compliance obligations. section 14.5
