r14n — Regulatory Localization Pack Specification (RLPS)

Pull regulatory rules out of your code — the way i18n pulled out your strings.

r14n : compliance controls :: i18n : strings

RLPS — the Regulatory Localization Pack Specification — maps a (regulatory-profile × jurisdiction × subject) to the set of required compliance controls, in human-diffable TOML packs, resolved fail-closed, with legal-review provenance and signed decision receipts.

Before / after

Before — rules tangled into app code

# pseudocode, any language
if any(participant in a two-party-consent state):
    require(consent)
else if any(participant in the EU):
    if ai_notetaker: require(announcement)
    require(consent)
# …dozens more brittle branches — invisible
# to a compliance reviewer, easy to get wrong

After — the same rules as a reviewable pack

# recording_consent.r14n.toml
[subject.twin_attend]
controls = ["announcement", "aph_mandate_principal_signed"]

[legally_required]  # the fail-closed floor
controls = ["attestation", "announcement",
            "signal_notice", "aph_mandate_principal_signed"]

The app stops deciding and just enforces what the resolver returns. A compliance officer and an engineer review the same file in the same pull request.

How it works

Packs

Small, content-addressed TOML files mapping a profile × domain to required controls — with posture selection, inheritance, temporal validity, and an attorney-of-record attestation envelope for jurisdiction claims.

A fail-closed resolver

Missing, malformed, or expired pack? Ambiguous jurisdiction? The resolver demands everything the app can enforce and loudly flags the fallback — it never silently under-restricts. Reference implementation in Rust, zero framework deps.

Signed receipts

Every decision serializes to an ISO/IEC TS 27560-structured, W3C DPV JSON-LD receipt — audit evidence of which pack drove the decision and whether provenance was verified. Advisory-only until a directory-listed reviewer's signature checks out.

A measured problem

38 / 11 / 1US recording-consent split: one-party states + DC / all-party / no wiretap statute (12 Harv. L. & Pol'y Rev. 177)

$98–112B / yrprojected out-of-state compliance cost of the US state privacy patchwork (ITIF, 2022)

1 → 131 / yrstate AI laws per year, 2016 → 2024 (Stanford HAI AI Index)

Regulators themselves are moving to machine-consumable rules (OECD "Rules as Code", the FCA/Bank of England machine-executable-regulation pilots). RLPS occupies one specific, un-owned layer in that lineage: the control-prescription layer — between legal text and application configuration — interoperating with NIST OSCAL, W3C DPV / ISO 27560, LegalRuleML, and OPA/Cedar rather than replacing them.

Status

v0.1 — draft, reference-implementation-first. The spec, a three-level conformance suite, the Rust resolver + r14n pack-lifecycle CLI, and Squillo's own posture baselines are public. Real-jurisdiction packs are deliberately held out until licensed counsel signs off — each will carry a named attorney of record. Governance, trademark, and conformance-claim rules live in the repository.