A lane is a family of workflows on one layer, and this is the clearest example of it: six workspaces, eighteen workflows, one reconciliation loop. Regulatory signals define what must be true; control signals report what is true; compliance is the continuous reconciliation of the two. Built against CPS 230, CPS 234, CPS 220, FAR and SOCI. The GRC system of record stays exactly where it is.
Each of these is a governed workflow in its own right — its own trigger, its own approver, its own memory. What makes them a lane is that they reconcile against each other.
Daily sweep of the regulator watchlist · full-document distillation on anything flagged · weekly “what is coming” briefing · monthly horizon report · open-consultation tracker.
Per-standard distillation with citations and a batch approval before entry · register adoption · weekly integrity check for unmapped obligations, imminent effective dates and stale reviews.
Control onboarding with a design-effectiveness questionnaire and reviewer approval · weekly control health · information-asset classification with a drift report.
Automated signal pull where the system yields it · automated evidence chase at control frequency where a person performs it · CI signal intake for the pipeline controls.
Monthly sampling of completed tests into a challenge pack, with an opinion recorded per sample. Independence is enforced by workspace membership, not by convention.
Quarterly board pack · incident notification drafts with the clock attached and a hard approval gate · per-person accountability view · risk score snapshots.
Live probes into production bank systems — verifying TLS posture or key management directly — need access decisions the bank has not made, so they are not in this lane. Line 2 and Line 3 judgment is not replaced; both gain a surface to work from. And there is no new engineering underneath any of it: the lane composes primitives that already existed.