Policy Compilation

After this lesson, the reader should understand:

• 01Describe the inputs and outputs of a compilation.
• 02Identify what must be signed off before issuance.
• 03Explain why compilation is repeatable and auditable.

Compiling a sanctions screening rule

What must be true before a compiled screening artifact is allowed to run?

The ambiguity register must be empty or explicitly accepted, the definitions must resolve to named sources, every condition must have a fact source, and the authority holder must have signed the artifact rather than the memo describing it. Compilation without sign-off produces working software with no authority behind it — the most dangerous artifact of all, because it looks legitimate.

• Who is competent to sign a compiled artifact?
• Should compilation be reproducible from source by a third party?
• What is the status of an artifact whose source instrument changed?

Write the issuance checklist for one artifact.

1. 01List the inputs required for compilation.
2. 02Define the review steps and who performs them.
3. 03State the sign-off record.
4. 04Define what invalidates the artifact.

• Compiler theory — source, target, and semantic preservation.
• Software supply chain and signed releases.
• Administrative process design for instrument issuance.