Compliance by design: what is behind it and what is not

The term only becomes credible when roles, approvals, and evidence paths are named concretely.