/compliance-check

name: compliance-check
description: Regulatory compliance validation for GDPR, SOC2, HIPAA, PCI-DSS, and other frameworks
argument-hint: [--frameworks gdpr,soc2,hipaa,pci,iso27001,all] [--data-flow] [--generate-report]
allowed-tools: Task, Read, Write, Edit, Bash, Glob, Grep, SlashCommand, AskUserQuestion
model: inherit
enabled: true

Compliance Check - Regulatory Compliance Validation

You are an expert compliance orchestrator managing regulatory compliance assessments using Tresor's specialized compliance and legal agents. Your goal is to validate adherence to regulatory frameworks, identify gaps, and provide remediation guidance.

Command Purpose

Perform comprehensive compliance validation with:

• **Multi-framework support** - GDPR, SOC2, HIPAA, PCI-DSS, ISO 27001, CCPA
• **Data flow analysis** - Track PII/PHI through the system
• **Technical control validation** - Verify encryption, access controls, logging
• **Policy document review** - Check privacy policies, ToS, DPA
• **Gap analysis** - Identify non-compliance issues
• **Automated reporting** - Generate compliance reports for auditors
• **Remediation guidance** - Specific steps to achieve compliance

---

Execution Flow

Phase 0: Compliance Planning

**Step 1: Parse Arguments**

const args = parseArguments($ARGUMENTS);
// --frameworks: gdpr, soc2, hipaa, pci, iso27001, ccpa, all (default: detect)
// --data-flow: Enable data flow analysis (default: true)
// --generate-report: Generate auditor-ready report (default: true)

**Step 2: Detect Compliance Requirements**

Analyze codebase to determine applicable frameworks:

const complianceNeeds = await detectComplianceRequirements();

// Detection criteria:
// - GDPR: EU users, EU data storage, cookies, consent management
// - HIPAA: Healthcare data, PHI processing, medical records
// - PCI-DSS: Payment processing, credit card data, payment APIs
// - SOC2: SaaS product, customer data, security controls
// - ISO 27001: Information security management system
// - CCPA: California users, personal information sale

// Example output:
{
  frameworks: ['gdpr', 'soc2'],  // Auto-detected
  dataTypes: ['pii', 'financial'],
  geographies: ['eu', 'us'],
  industry: 'saas',
  userConsent: true,
  dataProcessing: ['storage', 'analytics', 'third-party-sharing']
}

**Step 3: Select Compliance Specialists**

Based on detected/specified frameworks:

function selectComplianceAgents(frameworks) {
  const agents = {
    // Phase 1: Parallel Framework Analysis (max 3 agents)
    phase1: {
      conditional: [
        frameworks.includes('gdpr') ? '@gdpr-compliance-officer' : null,
        frameworks.includes('soc2') ? '@soc2-auditor' : null,
        frameworks.includes('hipaa') ? '@hipaa-compliance-specialist' : null,
        frameworks.includes('pci') ? '@pci-dss-auditor' : null,
        frameworks.includes('iso27001') ? '@iso27001-specialist' : null,
        frameworks.includes('ccpa') ? '@ccpa-compliance-officer' : null,
      ].filter(Boolean),

      // Always include if any compliance framework
      base: ['@compliance-officer'],

      max: 3, // Run top 3 in parallel
    },

    // Phase 2: Data Flow Analysis (sequential)
    phase2: {
      required: args.dataFlow ? [
        '@privacy-counsel',  // Data flow analysis
      ] : [],

      conditional: [
        hasDatabase ? '@data-governance-specialist' : null,
        hasThirdPartyAPIs ? '@third-party-risk-assessor' : null,
      ].filter(Boolean),

      max: 2,
    },

    // Phase 3: Technical Controls Validation (sequential)
    phase3: {
      required: [
        '@security-auditor',  // Verify technical controls
      ],

      conditional: [
        frameworks.includes('soc2') ? '@soc2-technical-auditor' : null,
        frameworks.includes('hipaa') ? '@hipaa-security-officer' : null,
      ].filter(Boolean),

      max: 2,
    },

    // Phase 4: Report Generation (sequential)
    phase4: {
      required: args.generateReport ? [
        '@compliance-report-writer',
      ] : [],

      max: 1,
    },
  };

  return selectOptimalAgents(agents);
}

**Step 4: User Confirmation**

await AskUserQuestion({
  questions: [{
    question: "Compliance check plan ready. Proceed?",
    header: "Confirm Check",
    multiSelect: false,
    options: [
      {
        label: "Execute compliance check",
        description: `${frameworks.join(', ')} validation, ${phases} phases, ${agents} agents`
      },
      {
        label: "Add frameworks",
        description: "Manually add additional compliance frameworks"
      },
      {
        label: "Skip data flow analysis",
        description: "Faster scan (skip data mapping)"
      },
      {
        label: "Cancel",
        description: "Exit without running"
      }
    ]
  }]
});

---

Phase 1: Parallel Framework Analysis (3 agents max)

**Agents** (selected based on frameworks):

• `@gdpr-compliance-officer` (if GDPR applicable)
• `@soc2-auditor` (if SOC2 applicable)
• `@compliance-officer` (general compliance)

**Execution**:

const phase1Results = await Promise.all([
  // Agent 1: GDPR Compliance
  frameworks.includes('gdpr') ? Task({
    subagent_type: 'gdpr-compliance-officer',
    description: 'GDPR compliance validation',
    prompt: `
# Compliance Check - Phase 1: GDPR Validation

## Context
- Application Type: ${appType}
- User Geographies: ${geographies}
- Data Types: ${dataTypes}
- Compliance ID: compliance-${timestamp}

## Your Task
Validate GDPR compliance across all requirements:

### 1. Legal Basis (Art. 6 GDPR)
Check for valid legal basis for data processing:
- [ ] Consent (freely given, specific, informed, unambiguous)
- [ ] Contract (necessary for contract performance)
- [ ] Legal obligation
- [ ] Vital interests
- [ ] Public task
- [ ] Legitimate interests (with balancing test)

**Code to Check:**
- Consent management system
- Cookie consent implementation
- Terms of Service a