Compliance Tags

Compliance tags are metadata labels applied to fields in your Data Contracts. Today, the CLI validates that tagged fields conform to the ODCS schema. In the future, these tags will trigger governance workflows and feed into risk scoring.

For an overview of the standards that ChooChoo builds upon, see the Standards Reference. For the formal schema definitions, see Schema Definitions.

Tag Taxonomy

Privacy & Data Protection

Healthcare & Finance

Data Classification

Risk Weight in Scoring

The risk weight assigned to each tag directly influences the Compliance Sensitivity (C) factor in the Risk Scoring algorithm. This factor carries a 30% weight in the overall score — the highest of all five factors.

When multiple tags are present on a single field, ChooChoo uses the highest risk weight among them. For example, a field tagged with both pii (weight 3) and gdpr-article-9 (weight 4) contributes a weight of 4 to the compliance sensitivity calculation.

See Risk Scoring for the full algorithm and score interpretation table.

Usage in Contracts

Tags are applied to individual fields in your Data Contracts using the complianceTags array:

models:
  - name: Customer
    type: table
    fields:
      - name: email
        type: string
        pii: true
        complianceTags: ["pii", "gdpr-article-6"]
        classification: confidential
      - name: health_status
        type: string
        complianceTags: ["pii", "gdpr-article-9", "hipaa"]
        classification: restricted

The pii: true flag is a shorthand that's equivalent to including pii in complianceTags. Both mechanisms trigger the same governance workflows.

Security Implications

Tags drive Security Considerations enforcement:

• Fields tagged with pii or higher are masked for agents with a no-pii boundary.
• Access to tagged fields is logged in the Audit Trail.
• Encryption requirements escalate with classification level — see Security Considerations for the encryption matrix.

Configuring Tag-Based Policies

Use the governance.requireApproval setting in .choochoorc to specify which tags always trigger mandatory human approval:

{
  "governance": {
    "requireApproval": ["pii", "hipaa", "gdpr-article-9", "restricted"]
  }
}

For more granular policies (e.g., requiring specific teams or SLAs), define them in .choochoo/approval-policies.yaml. See Approval Workflows for the full policy schema.

Compliance Reporting

Tags determine which artifacts appear in Compliance Reports. When you generate a report for a specific framework (e.g., --framework gdpr), ChooChoo filters the Audit Trail to include only changes that affected fields tagged with relevant compliance tags.

Related