Executable Responsibility Model (MAAT)
Context
MAAT was designed to support privacy consultants in performing structured GDPR compliance assessments for client organizations.
The objective was not to build a traditional management application, but to model organizational responsibilities, compliance checks, and risk evaluation rules directly inside the MySirt DSL, transforming regulatory obligations into executable operational behavior through a model derived from the execution meta-model.
Modeling Approach
The system models the elements required for GDPR compliance:
- organizational roles
- data processing activities
- risk classification
- security policies
- compliance verification questionnaires
These elements are defined in the MySirt DSL and compiled into an operational environment capable of guiding organizations through compliance assessment and documentation processes.
Operational Structure
- GDPR assessment questionnaire
- risk classification and mitigation tracking
- data processing registers
- compliance progress monitoring
- document templates for regulatory documentation
The resulting system supports privacy consultants in performing structured compliance assessments and generating documentation required for regulatory audits.
Risk classification interface generated from the compliance model, capturing probability, impact and mitigation rules.
Generative Evidence
Quantitative comparison between DSL definition and the generated runtime system.
The system is generated from the DSL model, which instantiates the execution meta-model, with only limited manual extensions for UI customization and compliance progress calculation.
Compliance progress monitoring derived from the organizational responsibility model.
Generated processing register supporting GDPR documentation and compliance tracking.
Architectural Significance
MAAT demonstrates that MySirt can encode regulatory obligations and transform them into executable operational environments.
Instead of manually developing compliance software, the organizational model itself becomes the source from which the system is generated.
Each compliance model represents a specific instantiation of the execution meta-model applied to regulatory domains.
Key Point
Regulatory responsibilities are modeled once and executed by the Execution Engine, turning compliance requirements into operational workflows rather than static documentation.