Regulatory Intelligence

Regulatory intelligence workflows sit above published regulatory packs. They keep legal truth in regulatory_serving, then add operational state for source monitoring and graph projections. Customer lifecycle work is stateless by default: clients send profile facts in a request and receive obligation and impact previews without storing customer state in Esheria. Hosted customer profiles, applicability runs, obligation instances, and customer change impacts remain available as opt-in operational state. Read and preview operations use regulatory:read. Source-watch mutations use monitoring:write, graph projection rebuild uses graph:write, and persisted customer lifecycle mutations use customer:write.

Source Monitoring

Source monitoring stores source watches, source snapshots, source-change events, and recompile candidates. Hosted watch URIs may be validated public HTTP(S) URLs or deployment-allow-listed s3://bucket/key objects. The public API rejects local files, private/link-local/metadata destinations, unsafe redirects, caller-selected S3 endpoints, unapproved buckets, oversized content, and oversized check batches. Local paths remain available only to the offline pipeline monitor. They are not reachable through the API or MCP.

CLI

esheria monitoring currentness --domain-pack-id UK-DATA-USE-AND-ACCESS --format json
esheria monitoring check --domain-pack-id UK-DATA-USE-AND-ACCESS --yes --format json
esheria monitoring recompile-candidates --domain-pack-id UK-DATA-USE-AND-ACCESS --format json

Binding source changes create recompile candidates. Guidance, watchlist, and context source changes are recorded as non-binding currentness signals.

Graph Projection

Graph projection rebuilds materialized graph tables from current published serving facts only. Draft, blocked, and citation-verified rows are excluded from authoritative graph truth and counted in coverage metadata.

CLI

esheria graph rebuild-projection --reason scheduled_rebuild --yes --format json
esheria graph coverage --domain-pack-id EU-NIS2-CYBERSECURITY --format json

Graph query uses the latest completed published projection when available, and falls back to stored relationship facts only when no projection has been built. Use graph query explain=true when a caller needs authority-source, publication-mode, projection-run, and draft/blocked exclusion details.

Customer Applicability

Use stateless lifecycle preview for the main data-infrastructure flow. It returns citation-backed obligation previews and change-impact previews, and the response marks persistence.writes_performed as false.

CLI

esheria customers preview \
  --pack UK-DATA-PROTECTION-PRIVACY \
  --role data_controller \
  --activity personal_data_processing \
  --sector financial_services \
  --format json

Hosted lifecycle state is opt-in. Customer profiles are workspace scoped. Applicability runs lock pack versions, return citation-backed results, and create customer obligation instances that reference published fact IDs instead of duplicating legal truth.

CLI

esheria customers create-profile \
  --name "Acme UK fintech" \
  --pack UK-DATA-PROTECTION-PRIVACY \
  --profile-file customer-profile.json \
  --format json

esheria customers run-applicability CUSTOMER_PROFILE_ID \
  --pack UK-DATA-PROTECTION-PRIVACY \
  --format json

esheria customers obligations \
  --customer-profile-id CUSTOMER_PROFILE_ID \
  --format json

esheria customers update-obligation CUSTOMER_OBLIGATION_INSTANCE_ID \
  --status monitoring \
  --priority high \
  --owner-label "Compliance lead" \
  --due-date 2026-07-31 \
  --format json

customer-profile.json can include entity_profile and profile_facts.

{
  "entity_profile": {
    "entity_roles": ["data_controller"],
    "regulated_activities": ["personal_data_processing"],
    "sector_tags": ["financial_services"]
  },
  "profile_facts": [
    {
      "fact_type": "entity_role",
      "value": "data_controller",
      "source": "customer_attestation",
      "confidence": 1.0
    }
  ]
}

Customer Change Impacts

Stateless previews can include change-impact previews. Hosted change impacts connect pack change events to stored customer obligation instances only when a customer opts into persisted lifecycle state.

CLI

esheria customers recompute-impacts \
  --customer-profile-id CUSTOMER_PROFILE_ID \
  --domain-pack-id UK-DATA-PROTECTION-PRIVACY \
  --format json

esheria customers impacts \
  --customer-profile-id CUSTOMER_PROFILE_ID \
  --format json

esheria customers update-impact CUSTOMER_CHANGE_IMPACT_ID \
  --status resolved \
  --format json

MCP Tools

The MCP server exposes the same workflows through:

esheria_get_source_currentness
esheria_check_source_watches
esheria_list_recompile_candidates
esheria_rebuild_graph_projection
esheria_get_graph_coverage
esheria_preview_customer_lifecycle
esheria_create_customer_profile
esheria_run_customer_applicability
esheria_list_customer_obligation_instances
esheria_update_customer_obligation_instance
esheria_recompute_customer_change_impacts
esheria_list_customer_change_impacts
esheria_update_customer_change_impact

​Source Monitoring

​Graph Projection

​Customer Applicability

​Customer Change Impacts

​MCP Tools

Source Monitoring

Graph Projection

Customer Applicability

Customer Change Impacts

MCP Tools