---
id: 05-compliance-overview
epic: compliance-docs-scaffolds
title: Write compliance-overview.md hub
type: user-story
status: todo
feature: ~
depends-on: [03-policy-templates, 04-pre-launch-compliance-checklist]
blocks: [06-doc-wiring]
created: 2026-05-20T12:00:00Z
updated: 2026-05-20T11:58:25.281Z
---

## Goal

Create `docs/guides/compliance-overview.md` as the single navigational entry point for compliance in this template. It maps each of the 22 playbook sections to the ADR / guide / template / epic that covers it, names ADR-025's deferrals and consumer/infra-scope items explicitly, and links outward to every compliance guide, ADR, and template.

## Why

After four epics, compliance documentation sprawls across `docs/compliance/`, `docs/guides/` (8+ files), `docs/decisions/` (6 ADRs), and root `compliance/`. An auditor, new engineer, or AI agent asked "is feature X compliant?" has no entry point and must reverse-engineer the structure from grep. ADR-025 designated this hub as the solution; it must be written last so it can link to finished templates + checklist.

## Done when

- `docs/guides/compliance-overview.md` exists.
- The file maps all 22 playbook sections; every row points at a real ADR, guide path, template path, or epic that covers it.
- A closing summary restates ADR-025's deferrals (RBAC, MFA, breach-detection, GDPR Art. 22) and the consumer/infra-scope items (EU region, TLS, MDM, legal instruments).
- The file links one-directionally to `docs/guides/pre-launch-compliance-checklist.md`, `docs/compliance/templates/*.template.md`, all relevant ADRs (`docs/decisions/`), and all relevant guides.
- Every relative Markdown link resolves to an existing file.
- Commit type is `docs(compliance)`.
- `pnpm lint && pnpm typecheck && pnpm test && pnpm conformance && pnpm fallow:audit` all pass.

## In scope

- `docs/guides/compliance-overview.md` — the 22-section hub with outbound links and deferrals summary.

## Out of scope

- Editing any existing ADR, guide, or template (one-directional only).
- Duplicating ADR-025's rationale — the overview is the navigational map, not the decision record.
- Replacing `docs/compliance/README.md` as the hub — README stays scoped to generator schema reference.

## Tasks

- [ ] Write `docs/guides/compliance-overview.md` mapping all 22 playbook sections to their covering ADR/guide/template/epic, with a closing deferrals summary (RBAC, MFA, breach-detection, GDPR Art. 22, EU region, TLS, MDM, legal instruments) and outbound links to all referenced files; verify every relative link resolves; commit as `docs(compliance): add compliance-overview hub`.