مراقبة الامتثال وإنفاذ السياسات

المتطلبات تصف قدرات يحتاجها النمط في بيئتك، مو الموردين اللي لازم تشتريهم. أي نظام يملأ متطلباً يحقّقه — وهذا اللي يخلّي الكتالوج قابلاً للنقل عبر الذيل الطويل من أدوات الشركات الصغيرة والمتوسطة.

1. monitored_activity_streams

   مطلوبقراءةحدث

   The streams of activity the pattern watches. Multiple sources, one pattern.

   شكل البيانات

   Event records from various systems with consistent metadata: actor, action, target, timestamp, optional context.
   يُملأ عادةً بواسطة

   • expense system event stream
   • access management logs
   • communications archives
   • purchase requisition events
   • code repository commits and pull requests for change-control
2. policy_rule_library

   مطلوبقراءةمجموعة

   The firm's policies expressed as testable rules. Critical that this is explicit and maintained: the pattern is only as good as the rules it checks against.

   شكل البيانات

   Per-policy: applicability conditions, the test, severity, suggested response. Mix of structured rules (amount thresholds) and content-based checks (does this communication contain prohibited claims).
   يُملأ عادةً بواسطة

   • structured policy library maintained by compliance and legal
   • rules engine the pattern reads from
   • small admin UI for policy authoring
3. actor_context_lookup

   مطلوبقراءةطلب

   Who the actor is: their role, their authority limits, their reporting line. Many policies depend on who's doing what.

   شكل البيانات

   Per-person: role, team, manager, approval authority, any active flags (e.g. probation, special handling).
   يُملأ عادةً بواسطة

   • HR directory with role and reporting structure
   • identity management system with permission grants
   • RACI matrix maintained by operations
4. violation_review_queue

   مطلوبكتابةطلب

   Where flagged violations go for human review. Most violations are not clear-cut and need someone to decide.

   شكل البيانات

   Flagged event with policy violated, evidence, actor context, severity, suggested action. Reviewer can confirm, dismiss, or escalate.
   يُملأ عادةً بواسطة

   • compliance review queue in the GRC tool
   • ticket queue for compliance officers
   • dashboard with prioritized cases
5. escalation_route

   مطلوبكتابةحدث

   Where high-severity violations route directly without waiting for queue processing.

   شكل البيانات

   Escalation event with full context and immediate notification to the responsible authority.
   يُملأ عادةً بواسطة

   • direct chat alert to the compliance officer or general counsel
   • phone call escalation for severe cases
   • automated email to the CEO or designated executive
6. audit_evidence_archive

   مطلوبكتابةمجموعة

   Long-term retention of all flags, reviews, and resolutions. Critical for the audit story this pattern is supposed to support.

   شكل البيانات

   Per-event: original activity, what policy was checked, the verdict, the human review if any, the resolution, retention period.
   يُملأ عادةً بواسطة

   • compliance archive in the GRC system
   • structured audit log with retention policies
   • evidence store accessible to external auditors
7. false_positive_feedback

   مطلوبقراءة + كتابةحدث

   How reviewers flag that something was incorrectly identified as a violation. Critical for tuning: false positives erode trust faster than missed violations.

   شكل البيانات

   Per-flag: was it valid, was the policy wrongly applied, was the rule too aggressive.
   يُملأ عادةً بواسطة

   • dismissal reason capture in the review queue
   • false-positive tag reviewers can apply
   • weekly retrospective with the compliance team