Compliance as Architecture

// Sentinel write-path interceptor — Rust implementation sketch
pub async fn sentinel_intercept(
    mutation: &RecordMutation,
    user: &AuthenticatedUser,
    frameworks: &[ComplianceFramework],
) -> Result<CommitResult, ComplianceRejection> {
    // Phase 1: Export control gate
    let classification = mutation.target_record.export_classification();
    if !user.authorized_for(classification) {
        audit_log::append_violation(user, mutation, "ITAR_ACCESS_DENIED");
        alert_empowered_official(user, mutation);
        return Err(ComplianceRejection::ExportControl);
    }

    // Phase 2: Framework-specific signature requirements
    for fw in frameworks {
        if fw.requires_signature(&mutation.action_type) {
            let sig = capture_esignature(user, mutation, fw).await?;
            verify_mfa(user, &sig)?;
            mutation.attach_signature(sig);
        }
    }

    // Phase 3: Compute field-level delta + append audit
    let delta = compute_field_delta(mutation);
    let entry = AuditEntry {
        user_id: user.unique_id(),
        timestamp: SystemClock::now_cryptographic(),
        action: mutation.action_type,
        record_id: mutation.target_id,
        delta, reason: mutation.reason_code,
        document_hash: mutation.compute_sha256(),
    };
    worm_store::append(entry).await?; // Append-only — cannot overwrite

    // Phase 4: Atomic commit — data + audit + signature
    axiom_graph::commit_atomic(mutation, entry).await
}