classroomio/prd/compliance-training-platform/README.md

Compliance Training Platform PRD

Status

• Draft

Date

• February 21, 2026

Purpose

Transform ClassroomIO into the go-to platform for companies that need to deliver, track, and prove compliance training for their employees. This PRD defines features for organizations in regulated industries (healthcare, finance, manufacturing, government) who must ensure their workforce stays compliant with regulations.

---

1. Executive Summary

The Problem

Companies in regulated industries struggle to:

• Assign the right training to the right people based on their role/location
• Track who completed training on time and who is overdue
• Remind employees before deadlines and escalate to managers
• Prove compliance to auditors with tamper-proof records
• Renew certifications automatically when they expire

Target Customers

Industry	Example Use Cases
Healthcare	HIPAA training, patient safety, infection control, medical device handling
Financial Services	Anti-money laundering, fraud prevention, data privacy, trading compliance
Manufacturing	OSHA safety, quality control (ISO), hazardous materials handling
Government	Security clearance, ethics training, procurement rules, FISMA
Education	FERPA, Title IX, campus safety, student data handling
Retail/Hospitality	Food safety, anti-harassment, PCI-DSS, workplace safety

Solution Overview

ClassroomIO becomes a Compliance Training Management System that helps organizations:

1. Deploy compliance training programs efficiently
2. Automate assignment, reminders, and renewals
3. Monitor compliance status in real-time
4. Report audit-ready evidence instantly
5. Scale across thousands of employees and multiple locations

---

2. Current State vs. Required Features

✅ What ClassroomIO Already Does Well

Feature	Current Capability	Compliance Gap
Course Creation	Rich content editor, videos, documents	✅ Good enough
Assessments	Basic exercises with grading	⚠️ Need more question types & pass/fail rules
Certificates	Generate PDF certificates	⚠️ Need expiration, renewal, revocation
User Management	Invite students, track progress	⚠️ Need bulk assignment by role/department
SSO	OIDC/SAML integration	✅ Enterprise-ready
Basic Reporting	Course completion stats	❌ Need compliance-specific dashboards

❌ Critical Missing Features for Compliance Training

Missing Feature	Why It Matters	Customer Pain
Mandatory Training Assignment	Compliance training isn't optional - everyone in a role MUST complete it	Currently can only invite, can't enforce
Recurring/Refresh Training	Many regulations require annual/quarterly retraining	No automated renewal system
Compliance Dashboard	See who is compliant, who is overdue, by department/role	No bird's-eye view for compliance officers
Policy Acknowledgment	Track who read and agreed to policies	No policy attestation workflow
Audit Trail	Prove "who did what when" to auditors	No immutable activity log
Automated Reminders	Notify employees before deadlines, escalate to managers	Manual follow-up is unsustainable
Evidence Export	One-click export of training records for auditors	Manual report generation takes hours

---

3. Feature Requirements

3.1 Compliance Training Programs (The Container)

Purpose

A "Program" groups related training requirements (e.g., "Annual HIPAA Compliance" or "New Hire Safety Training"). This is the top-level entity compliance officers manage.

Requirements

CP-1: Program Management

• Create programs with title, description, and regulatory framework (e.g., "HIPAA", "OSHA", "SOX")
• Set program status: draft, active, archived
• Assign program owner (compliance officer responsible)
• Add custom fields for internal tracking (department codes, cost centers, etc.)

CP-2: Program Content

• Link multiple courses/lessons to a program (e.g., HIPAA includes: Basics course, Security course, Quiz)
• Set completion rules:
  • "Complete all courses"
  • "Complete any 2 of 3 courses"
  • "Complete Course A AND (Course B OR Course C)"
• Set passing criteria: minimum score, attempt limits, time between retakes

CP-3: Program Assignment Rules

• Assign by: role, department, location, employment type, custom attributes
• Examples:
  • "All nurses in California hospitals"
  • "All new hires in first 30 days"
  • "All employees with security clearance Level 2+"
• Support exclusions (e.g., "All managers EXCEPT contractors")

CP-4: Program Schedule

• One-time assignment (e.g., new hire training)
• Recurring: every N months/years from completion date OR fixed date
• Grace period: days after due date before marked overdue
• Prerequisites: must complete Program X before starting Program Y

Database Schema

-- Compliance training programs
CREATE TABLE compliance_program (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  organization_id UUID NOT NULL REFERENCES organization(id),
  title VARCHAR NOT NULL,
  description TEXT,
  framework VARCHAR, -- 'HIPAA', 'OSHA', 'SOX', 'GDPR', 'Custom'
  status VARCHAR DEFAULT 'draft', -- 'draft', 'active', 'archived'
  owner_id UUID REFERENCES profile(id),
  completion_rule JSONB NOT NULL DEFAULT '{"type": "all"}', -- { type: 'all' | 'any' | 'minimum', count: number }
  passing_criteria JSONB NOT NULL DEFAULT '{"minScore": 80, "maxAttempts": 3}',
  schedule_config JSONB NOT NULL DEFAULT '{}', -- { type: 'once' | 'recurring', intervalMonths: 12, graceDays: 7 }
  custom_fields JSONB DEFAULT '{}',
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Program content (courses/exercises linked to program)
CREATE TABLE compliance_program_content (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  program_id UUID NOT NULL REFERENCES compliance_program(id),
  content_type VARCHAR NOT NULL, -- 'course', 'exercise', 'lesson'
  content_id UUID NOT NULL,
  is_required BOOLEAN DEFAULT true,
  order_index INTEGER DEFAULT 0,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Assignment rules (who gets this program)
CREATE TABLE compliance_program_assignment (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  program_id UUID NOT NULL REFERENCES compliance_program(id),
  rule_type VARCHAR NOT NULL, -- 'role', 'group', 'location', 'attribute', 'all'
  rule_value JSONB NOT NULL, -- { roleIds: [], groupIds: [], location: '', attributes: {} }
  is_exclusion BOOLEAN DEFAULT false,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

---

3.2 Learner Assignments & Tracking

Purpose

Track each learner's obligation, progress, and completion status for every program they're assigned.

Requirements

LA-1: Assignment Lifecycle

• Assigned: User meets assignment rule criteria → creates assignment
• In Progress: User started but not completed
• Completed: User met all completion rules
• Overdue: Past due date + grace period
• Waived: Admin exempted user (with reason and expiration)
• Expired: Previous completion past validity period → needs renewal

LA-2: Assignment Attributes

• Assigned date, due date, completed date
• Current status and status history with timestamps
• Attempts count, best score, time spent
• Certificate issued (if applicable)
• Reminder history (when reminders were sent)

LA-3: Bulk Operations

• Bulk assign to users matching criteria
• Bulk extend due dates (e.g., grant extension to entire department)
• Bulk waive with reason
• Bulk re-enroll (force retake even if completed)

LA-4: Self-Service Portal (for Learners)

• "My Compliance" dashboard showing all assigned programs
• Visual indicators: due soon (yellow), overdue (red), completed (green)
• Download certificates for completed programs
• See upcoming renewals

Database Schema

-- Individual learner assignments
CREATE TABLE compliance_assignment (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  organization_id UUID NOT NULL REFERENCES organization(id),
  program_id UUID NOT NULL REFERENCES compliance_program(id),
  user_id UUID NOT NULL REFERENCES user(id),
  
  -- Assignment details
  assigned_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  due_date TIMESTAMPTZ NOT NULL,
  grace_period_days INTEGER DEFAULT 0,
  
  -- Status tracking
  status VARCHAR NOT NULL DEFAULT 'assigned', -- 'assigned', 'in_progress', 'completed', 'overdue', 'waived', 'expired'
  status_changed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  status_history JSONB DEFAULT '[]', -- [{ status, timestamp, reason }]
  
  -- Progress
  started_at TIMESTAMPTZ,
  completed_at TIMESTAMPTZ,
  progress_percent INTEGER DEFAULT 0,
  
  -- Results
  attempts INTEGER DEFAULT 0,
  best_score INTEGER,
  passing_score INTEGER,
  time_spent_minutes INTEGER,
  
  -- Certificate
  certificate_id UUID,
  
  -- Waiver (if applicable)
  waived_at TIMESTAMPTZ,
  waived_by UUID REFERENCES profile(id),
  waiver_reason TEXT,
  waiver_expires_at TIMESTAMPTZ,
  
  -- For recurring programs
  is_renewal BOOLEAN DEFAULT false,
  previous_assignment_id UUID REFERENCES compliance_assignment(id),
  
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  
  UNIQUE(program_id, user_id, is_renewal) -- One active assignment per program per user
);

-- Assignment content progress (track individual courses within program)
CREATE TABLE compliance_assignment_progress (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  assignment_id UUID NOT NULL REFERENCES compliance_assignment(id),
  content_type VARCHAR NOT NULL,
  content_id UUID NOT NULL,
  status VARCHAR NOT NULL DEFAULT 'not_started', -- 'not_started', 'in_progress', 'completed', 'failed'
  started_at TIMESTAMPTZ,
  completed_at TIMESTAMPTZ,
  score INTEGER,
  attempts INTEGER DEFAULT 0,
  time_spent_minutes INTEGER,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

---

3.3 Automated Notifications & Escalations

Purpose

Ensure employees complete training on time without manual follow-up from compliance teams.

Requirements

NE-1: Reminder Schedule

• Configurable reminder schedule per program (e.g., 30, 14, 7, 1 days before due)
• Customizable email templates per reminder stage
• Include: program name, due date, progress, direct link to training

NE-2: Escalation Paths

• Level 1: Reminder to learner
• Level 2: Notify learner + CC manager (when overdue)
• Level 3: Escalate to compliance admin + learner's skip-level manager
• Level 4: Flag for HR/executive review

NE-3: Manager Notifications

• Weekly digest of team's compliance status
• Immediate alert when direct report goes overdue
• Dashboard showing team compliance rate

NE-4: Compliance Team Alerts

• Daily summary of new overdue assignments
• Alert when large group approaches deadline (e.g., "50 employees due in 3 days")
• System health alerts (failed email deliveries, sync errors)

NE-5: Notification Preferences

• Email, in-app notification, or both
• SMS for critical alerts (optional add-on)
• Digest mode vs. immediate notifications

Database Schema

-- Notification templates
CREATE TABLE compliance_notification_template (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  organization_id UUID NOT NULL REFERENCES organization(id),
  name VARCHAR NOT NULL,
  trigger_type VARCHAR NOT NULL, -- 'reminder', 'overdue', 'escalation', 'completion'
  trigger_days INTEGER, -- days before/after event (negative = before, positive = after)
  subject_template VARCHAR NOT NULL,
  body_template TEXT NOT NULL,
  recipients VARCHAR[] NOT NULL, -- ['learner', 'manager', 'compliance_admin']
  is_active BOOLEAN DEFAULT true,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Notification queue and history
CREATE TABLE compliance_notification (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  assignment_id UUID NOT NULL REFERENCES compliance_assignment(id),
  template_id UUID REFERENCES compliance_notification_template(id),
  notification_type VARCHAR NOT NULL,
  recipient_type VARCHAR NOT NULL, -- 'learner', 'manager', 'admin'
  recipient_id UUID NOT NULL,
  recipient_email VARCHAR NOT NULL,
  scheduled_at TIMESTAMPTZ NOT NULL,
  sent_at TIMESTAMPTZ,
  status VARCHAR NOT NULL DEFAULT 'pending', -- 'pending', 'sent', 'delivered', 'failed', 'bounced'
  error_message TEXT,
  opened_at TIMESTAMPTZ,
  clicked_at TIMESTAMPTZ,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Notification schedule (tracks what reminders are due)
CREATE TABLE compliance_notification_schedule (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  assignment_id UUID NOT NULL REFERENCES compliance_assignment(id),
  reminder_type VARCHAR NOT NULL, -- '30_days', '14_days', '7_days', '1_day', 'overdue', 'escalation'
  scheduled_at TIMESTAMPTZ NOT NULL,
  is_sent BOOLEAN DEFAULT false,
  sent_at TIMESTAMPTZ,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

---

3.4 Policy Attestation (Read & Acknowledge)

Purpose

Not all compliance is "training" - sometimes employees just need to read and acknowledge a policy. Track who has read and agreed to important documents.

Requirements

PA-1: Policy Management

• Upload policy documents (PDF, Word, HTML)
• Version control with version numbers and effective dates
• Categorize (Security, HR, Safety, Code of Conduct, etc.)
• Set required reading time (e.g., "Must view for at least 5 minutes")

PA-2: Attestation Workflow

1. Employee receives notification of new/updated policy
2. Employee opens and reads the document (viewer tracks time)
3. Employee checks "I have read and understand this policy"
4. Employee digitally "signs" with name, date, employee ID
5. System records: user, policy version, timestamp, IP, time spent reading

PA-3: Attestation Tracking

• Who has attested to which version
• Who hasn't attested (and how overdue)
• Bulk attestation for initial rollout (with verification)
• Re-attestation required when policy version changes

PA-4: Attestation Certificate

• Generate proof of attestation per employee
• Include: policy name, version, attestation date, digital signature hash

Database Schema

-- Policy documents
CREATE TABLE compliance_policy (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  organization_id UUID NOT NULL REFERENCES organization(id),
  title VARCHAR NOT NULL,
  description TEXT,
  category VARCHAR NOT NULL, -- 'security', 'hr', 'safety', 'conduct', 'privacy'
  status VARCHAR DEFAULT 'draft', -- 'draft', 'active', 'archived'
  requires_reading_time_seconds INTEGER DEFAULT 0,
  created_by UUID NOT NULL REFERENCES profile(id),
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Policy versions
CREATE TABLE compliance_policy_version (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  policy_id UUID NOT NULL REFERENCES compliance_policy(id),
  version_number INTEGER NOT NULL,
  content_url TEXT NOT NULL, -- S3/MinIO URL
  content_hash TEXT NOT NULL,
  effective_date TIMESTAMPTZ NOT NULL,
  requires_reattestation BOOLEAN DEFAULT true,
  created_by UUID NOT NULL REFERENCES profile(id),
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  UNIQUE(policy_id, version_number)
);

-- Who needs to attest to which policy version
CREATE TABLE compliance_policy_assignment (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  policy_version_id UUID NOT NULL REFERENCES compliance_policy_version(id),
  assigned_to_type VARCHAR NOT NULL, -- 'role', 'group', 'department', 'all'
  assigned_to_id UUID,
  due_date TIMESTAMPTZ,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Attestation records (immutable)
CREATE TABLE compliance_policy_attestation (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  policy_version_id UUID NOT NULL REFERENCES compliance_policy_version(id),
  user_id UUID NOT NULL REFERENCES user(id),
  attested_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  ip_address INET,
  user_agent TEXT,
  time_spent_seconds INTEGER,
  digital_signature VARCHAR NOT NULL, -- hash of user+policy+timestamp
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  UNIQUE(policy_version_id, user_id)
);

---

3.5 Certificates with Lifecycle Management

Purpose

Issue certificates that expire, track renewals, and maintain a complete history for audit purposes.

Requirements

CE-1: Certificate Templates

• Design certificate templates per program
• Include: recipient name, program name, completion date, expiration date, certificate ID, QR code for verification
• Custom fields (CE credits, accreditation body, instructor name)

CE-2: Certificate Issuance

• Auto-issue upon program completion
• Manual issue by admin (for external training imported into system)
• Bulk issue for historical data import

CE-3: Certificate Lifecycle

• Valid: Currently valid certificate
• Expiring Soon: Within renewal window
• Expired: Past expiration date
• Revoked: Invalidated (with reason and revoked_by)
• Renewed: Replaced by newer certificate (link to new cert)

CE-4: Certificate Verification

• Public verification page (for external auditors)
• QR code on certificate links to verification
• Shows: valid/invalid/revoked status, original issue details

CE-5: Certificate History

• Complete chain: Original → Renewal 1 → Renewal 2 → Current
• Never delete - maintain full history even after revocation

Database Schema

-- Certificate definitions (linked to programs)
CREATE TABLE compliance_certificate_definition (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  organization_id UUID NOT NULL REFERENCES organization(id),
  program_id UUID NOT NULL REFERENCES compliance_program(id),
  name VARCHAR NOT NULL,
  template_url TEXT NOT NULL, -- S3/MinIO URL to template file
  validity_period_months INTEGER NOT NULL, -- 0 = no expiration
  renewal_window_days INTEGER DEFAULT 30,
  ce_credits DECIMAL(4,2), -- continuing education credits
  accreditation_body VARCHAR,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Issued certificates
CREATE TABLE compliance_certificate (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  certificate_number VARCHAR UNIQUE NOT NULL, -- human-readable number
  definition_id UUID NOT NULL REFERENCES compliance_certificate_definition(id),
  user_id UUID NOT NULL REFERENCES user(id),
  assignment_id UUID NOT NULL REFERENCES compliance_assignment(id),
  
  -- Certificate data
  issued_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  issued_by UUID NOT NULL REFERENCES profile(id),
  expires_at TIMESTAMPTZ,
  
  -- Certificate file
  certificate_url TEXT NOT NULL,
  certificate_hash TEXT NOT NULL,
  
  -- Lifecycle
  status VARCHAR DEFAULT 'valid', -- 'valid', 'expiring_soon', 'expired', 'revoked', 'renewed'
  revoked_at TIMESTAMPTZ,
  revoked_by UUID REFERENCES profile(id),
  revoke_reason TEXT,
  
  -- Renewal chain
  is_renewal BOOLEAN DEFAULT false,
  previous_certificate_id UUID REFERENCES compliance_certificate(id),
  renewed_by_certificate_id UUID REFERENCES compliance_certificate(id),
  
  -- Verification
  verification_token VARCHAR UNIQUE NOT NULL, -- for public verification URL
  
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

---

3.6 Compliance Dashboard & Reporting

Purpose

Give compliance officers and managers real-time visibility into organizational compliance posture.

Requirements

CD-1: Organization Compliance Overview

• Overall compliance rate (% of required training completed on time)
• Breakdown by: program, department, location, role
• Risk indicators: overdue count, expiring soon count, non-compliant departments
• Trend lines: compliance rate over time

CD-2: Program-Level Dashboard

• Assignment status pie chart (completed, in progress, overdue, not started)
• Completion rate over time
• Average time to complete
• Pass/fail rates for assessments
• Upcoming due dates calendar view

CD-3: Individual Learner View

• Complete training history
• Current assignments and status
• Certificates earned (with download links)
• Policy attestations
• Compliance "score" or rating

CD-4: Alerts & Warnings

• High-risk situations: "50 people overdue on HIPAA training"
• Approaching deadlines: "200 certifications expire next month"
• Completion milestones: "90% of organization completed annual training"

CD-5: Manager Dashboard

• My team's compliance rate
• Direct reports' individual status
• Overdue notifications sent
• Team comparison to organization average

CD-6: Audit Reports

• One-click generation of compliance packages
• Include: training records, certificates, policy attestations, audit log excerpt
• Tamper-evident (checksums, signed manifest)
• Date range selection
• Filter by: program, department, individual

API Endpoints

// Organization compliance overview
GET /compliance/dashboard/overview
  Response: {
    overallComplianceRate: number;
    totalAssignments: number;
    completedOnTime: number;
    completedLate: number;
    overdue: number;
    inProgress: number;
    notStarted: number;
    expiringSoon30Days: number;
    expiringSoon90Days: number;
    byProgram: ProgramComplianceSummary[];
    byDepartment: DepartmentComplianceSummary[];
    trends: { date: string; rate: number }[];
  }

// Program detail dashboard
GET /compliance/dashboard/programs/:programId
  Response: {
    program: ComplianceProgram;
    stats: {
      totalAssigned: number;
      completed: number;
      inProgress: number;
      overdue: number;
      averageCompletionTime: number;
      passRate: number;
    };
    statusBreakdown: { status: string; count: number; percentage: number }[];
    upcomingDueDates: { date: string; count: number }[];
    recentCompletions: AssignmentSummary[];
    atRiskLearners: AssignmentSummary[]; -- overdue or due soon
  }

// Generate audit report
POST /compliance/reports/audit-package
  Body: {
    title: string;
    dateRange: { start: string; end: string };
    filters: {
      programs?: string[];
      departments?: string[];
      users?: string[];
    };
    include: {
      trainingRecords: boolean;
      certificates: boolean;
      policyAttestations: boolean;
      auditLog: boolean;
    };
  }
  Response: {
    reportId: string;
    status: 'generating' | 'ready' | 'failed';
    downloadUrl?: string;
    expiresAt?: string;
    manifest: {
      generatedAt: string;
      generatedBy: string;
      recordCounts: Record<string, number>;
      checksums: Record<string, string>;
    };
  }

// Learner compliance profile
GET /compliance/learners/:userId/profile
  Response: {
    user: UserSummary;
    currentAssignments: AssignmentDetails[];
    completedPrograms: CompletedProgram[];
    certificates: CertificateSummary[];
    policyAttestations: AttestationSummary[];
    complianceScore: number;
    riskLevel: 'low' | 'medium' | 'high';
  }

---

3.7 Audit Trail & Evidence

Purpose

Provide immutable, tamper-evident records of all compliance-related activities for auditor review.

Requirements

AT-1: Comprehensive Event Logging Log every compliance-relevant action:

• Program created, modified, archived
• Assignment created, completed, waived, expired
• Certificate issued, revoked, renewed
• Policy published, attested
• Notification sent, opened, clicked
• Report generated, downloaded
• Admin actions (bulk operations, settings changes)

AT-2: Log Entry Content

• Timestamp (UTC, millisecond precision)
• Actor (user ID, role, email)
• Action type and description
• Affected resources (program, assignment, user)
• Before/after values for changes
• IP address and user agent
• Session ID

AT-3: Audit Log Characteristics

• Append-only (no modifications allowed)
• Retained for 7+ years (configurable)
• Exportable to CSV/JSON/PDF
• Full-text searchable
• Filterable by: date range, actor, action type, resource

AT-4: Evidence Integrity

• Cryptographic hash chain linking entries
• Regular integrity verification reports
• Tamper detection alerts

Database Schema

-- Audit event log (append-only)
CREATE TABLE compliance_audit_event (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  organization_id UUID NOT NULL REFERENCES organization(id),
  timestamp TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  
  -- Actor
  actor_id UUID REFERENCES user(id),
  actor_email VARCHAR,
  actor_role VARCHAR,
  
  -- Action
  action_category VARCHAR NOT NULL, -- 'program', 'assignment', 'certificate', 'policy', 'report', 'admin'
  action_type VARCHAR NOT NULL, -- 'created', 'updated', 'completed', 'revoked', etc.
  action_description TEXT,
  
  -- Resources
  resource_type VARCHAR, -- 'program', 'assignment', 'user', 'certificate'
  resource_id UUID,
  resource_name VARCHAR,
  
  -- Details
  changes JSONB, -- { field: { from: x, to: y } }
  metadata JSONB, -- additional context
  
  -- Context
  ip_address INET,
  user_agent TEXT,
  session_id UUID,
  
  -- Integrity
  previous_hash VARCHAR,
  entry_hash VARCHAR NOT NULL, -- hash of this entry including previous_hash
  
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX idx_audit_org_time ON compliance_audit_event(organization_id, timestamp DESC);
CREATE INDEX idx_audit_action ON compliance_audit_event(action_category, action_type);
CREATE INDEX idx_audit_resource ON compliance_audit_event(resource_type, resource_id);
CREATE INDEX idx_audit_actor ON compliance_audit_event(actor_id);

---

4. User Experience Flows

4.1 Compliance Officer Journey

1. Create Compliance Program
   ↓
2. Add Content (courses, assessments)
   ↓
3. Set Assignment Rules (who needs to complete)
   ↓
4. Configure Schedule & Reminders
   ↓
5. Launch Program → System auto-assigns to users
   ↓
6. Monitor Dashboard → See completion rates, overdue alerts
   ↓
7. Send Reminders / Escalate / Waive as needed
   ↓
8. Generate Audit Report → Export for auditor

4.2 Employee (Learner) Journey

1. Receive Email: "New Required Training: HIPAA Compliance"
   ↓
2. Click Link → Login (if needed) → Go to "My Compliance" dashboard
   ↓
3. See: List of assigned programs with due dates
   ↓
4. Click Program → Start Training
   ↓
5. Complete Courses/Assessments
   ↓
6. Receive Certificate + Confirmation Email
   ↓
7. Certificate stored in "My Certificates" for future reference

4.3 Manager Journey

1. Weekly Email Digest: "Your Team's Compliance Status"
   ↓
2. Click to Manager Dashboard
   ↓
3. See: Team compliance rate, who's overdue, who's due soon
   ↓
4. Drill into individual → See their assignments
   ↓
5. Send reminder to specific team member
   ↓
6. Get notified when team member completes overdue training

4.4 Auditor Journey

1. Compliance officer generates "Audit Package" 
   ↓
2. Secure download link sent to auditor (time-limited)
   ↓
3. OR: Auditor given time-limited read-only portal access
   ↓
4. Auditor views/downloads:
      - Training completion records
      - Certificates with verification
      - Policy attestations
      - Activity audit log
   ↓
5. All auditor activity is itself logged

---

5. Implementation Roadmap

Phase 1: Core Assignment & Tracking (Weeks 1-6)

Goal: Basic compliance program delivery

Task	Duration	Deliverable
Compliance program data model	3 days	Database schema
Program CRUD API	4 days	Backend endpoints
Assignment engine	5 days	Auto-assignment logic
Basic compliance dashboard	5 days	Compliance overview UI
"My Compliance" learner view	4 days	Learner dashboard
Assignment tracking	4 days	Progress tracking UI
Milestone		Companies can assign and track compliance training

Phase 2: Notifications & Reminders (Weeks 7-10)

Goal: Automated follow-up without manual work

Task	Duration	Deliverable
Notification template system	3 days	Template CRUD API/UI
Reminder scheduling engine	4 days	Background job processor
Email delivery & tracking	3 days	Sendgrid/SES integration
Manager notifications	3 days	Manager digest & alerts
Escalation workflows	4 days	Multi-level escalation
Milestone		Fully automated reminder system

Phase 3: Certificates & Renewals (Weeks 11-14)

Goal: Complete certification lifecycle

Task	Duration	Deliverable
Certificate templates	3 days	Template designer
Certificate generation	3 days	PDF generation
Certificate lifecycle mgmt	4 days	Expire, revoke, renew
Recurring assignment engine	4 days	Auto-renewal logic
Expiration dashboard	3 days	Renewals view
Milestone		Automated renewal cycles

Phase 4: Policy Attestation (Weeks 15-18)

Goal: Policy acknowledgment tracking

Task	Duration	Deliverable
Policy document management	3 days	Policy CRUD
Document viewer with tracking	4 days	Time-on-page tracking
Attestation workflow	3 days	Sign/acknowledge flow
Attestation dashboard	3 days	Who's attested view
Milestone		Policy attestation system

Phase 5: Reporting & Audit (Weeks 19-24)

Goal: Audit-ready evidence and reporting

Task	Duration	Deliverable
Audit event logging	4 days	Event capture system
Audit log viewer & export	4 days	Log UI
Advanced dashboards	5 days	Drill-down reports
Audit package generator	5 days	One-click export
Auditor portal (read-only)	5 days	External auditor access
Milestone		Full audit readiness

Phase 6: Integrations & Scale (Weeks 25-30)

Goal: Enterprise integrations

Task	Duration	Deliverable
HRIS integration (Workday, BambooHR)	2 weeks	User sync
SCIM provisioning	1 week	Automated user lifecycle
Advanced analytics	1 week	Trend analysis, predictions
API for external systems	1 week	Public API endpoints
Milestone		Enterprise-ready platform

---

6. Technical Architecture

New API Routes

/compliance/programs              # CRUD for compliance programs
/compliance/assignments           # Assignment management
/compliance/assignments/:id/progress  # Track learner progress
/compliance/certificates          # Certificate lifecycle
/compliance/policies              # Policy document management
/compliance/attestations          # Policy acknowledgment
/compliance/dashboard             # Dashboard data
/compliance/reports               # Report generation
/compliance/audit-events          # Audit log access
/compliance/notifications         # Notification management
/compliance/settings              # Organization compliance settings

Background Jobs

assignment-processor      # Create assignments based on rules
reminder-scheduler        # Queue upcoming reminders
notification-sender       # Send emails/SMS
expiration-checker        # Mark expired certifications
renewal-processor         # Create renewal assignments
report-generator          # Generate large audit reports
audit-archiver            # Archive old audit logs

Frontend Features

apps/dashboard/src/lib/features/compliance/
  pages/
    programs-list.svelte
    program-editor.svelte
    assignments.svelte
    dashboard.svelte
    reports.svelte
    audit-log.svelte
    settings.svelte
  components/
    program-card.svelte
    assignment-status-badge.svelte
    compliance-chart.svelte
    notification-template-editor.svelte
    certificate-viewer.svelte
    policy-uploader.svelte
    attestation-flow.svelte
  api/
    compliance.svelte.ts
  utils/
    types.ts
    constants.ts

---

7. Success Metrics

Product Metrics

Metric	Target	Measurement
Time to create compliance program	< 30 minutes	User testing
Time to assign training to 1000 people	< 5 minutes	Performance test
Training completion rate	> 90%	Dashboard tracking
Automated reminder open rate	> 60%	Email analytics
Time to generate audit report	< 2 minutes	Performance test

Business Metrics

Metric	Target
Compliance-focused customer acquisition	10 new customers in 6 months
Compliance feature NPS	> 50
Customer retention (compliance segment)	> 95%
Expansion revenue from compliance add-on	20% of ARR

---

8. Competitive Differentiation

Feature	ClassroomIO	Competitors (LMS)	Compliance Tools
Course creation quality	✅ Strong	✅ Strong	❌ Weak
Compliance-specific features	🆕 Building	⚠️ Limited	✅ Strong
Price	💰 Affordable	💰💰 Expensive	💰💰💰 Very expensive
Open Source	✅ Yes	❌ No	❌ No
Self-hosted option	✅ Yes	⚠️ Limited	❌ Rare
Ease of use	✅ Simple	⚠️ Complex	❌ Complex

Positioning: "The compliance training platform that doesn't suck - powerful enough for enterprise compliance, simple enough for anyone to use."

---

9. Open Questions

1. Should we offer pre-built compliance program templates (e.g., "HIPAA Basics")?
2. Do we need integration with third-party course libraries (Skillsoft, LinkedIn Learning)?
3. Should we support instructor-led training tracking (ILT) or self-paced only?
4. How important is mobile app support for field workers?
5. Do we need e-signature integration (DocuSign) for high-stakes certifications?
6. Should we build a marketplace for compliance content creators?

---

10. Next Steps

1. Validate this PRD with 3-5 compliance officers at target companies
2. Prioritize Phase 1 features for immediate development
3. Design the compliance dashboard UI mockups
4. Prototype the program creation wizard
5. Plan data migration strategy for existing ClassroomIO courses