# Continuous Compliance

> The ability to check compliance on every change, with automated policy gates and evidence capture.

Record: `architecture:continuous-compliance`
Kind: capability
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: contextual
Scope: CI/CD, infrastructure, codebase
Canonical: https://banes-lab.com/ontology#architecture-continuous-compliance

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Risk Management](https://banes-lab.com/records/architecture/risk-management.md) and before [CSRF Protection](https://banes-lab.com/records/architecture/csrf-protection.md).

## Repair

- Refactored by: Add Automated Evidence, Add Policy Gates
- Detected by: missing automated compliance checks
- Violated by: compliance verified only manually/reactively
- Measured by: continuous control pass rate
- Enforced by: CI/CD controls

## Requires

- [Policy as Code](https://banes-lab.com/records/architecture/policy-as-code.md)
- [Evidence Automation](https://banes-lab.com/records/lexicon/evidence-automation.md)

## Reinforces

- [Compliance](https://banes-lab.com/records/architecture/compliance.md)
- [Auditability](https://banes-lab.com/records/architecture/auditability.md)

## Enables

- [Ongoing Assurance](https://banes-lab.com/records/lexicon/ongoing-assurance.md)

## Conflicts with

- [Point-in-Time Audit Only](https://banes-lab.com/records/lexicon/point-in-time-audit-only.md)

## In tension with

- [Pipeline Complexity](https://banes-lab.com/records/lexicon/pipeline-complexity.md)

## Tensions

- [Continuous Compliance / Pipeline Complexity](https://banes-lab.com/records/tension/continuous-compliance-pipeline-complexity.md)

## Severity

- [contextual](https://banes-lab.com/records/vocabulary/severity-contextual.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Linked from

- [Observability / Auditability / Traceability](https://banes-lab.com/ontology/principles/architecture-category-observability-auditability-traceability.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)