Reference — Declared Available now

@ComplianceControl

Marks a method as implementing a compliance control, the same way you already mark @Transactional or @Cacheable. The build plugin extracts it from compiled bytecode at build time.

Fields

Field	Type	Required	Description
`id`	`String`	Yes	Unique control identifier, e.g. `consent.capture`. You choose the naming scheme — it just has to be stable across builds.
`framework`	`String`	Yes	Which framework:criterion this control satisfies, e.g. `GDPR:Art.30`, `SOC2:CC6.1`. See supported frameworks.

That's the whole surface — two required fields, both strings. Keeping it minimal is deliberate: the annotation identifies a control, it doesn’t try to model the control's business logic.

Retention is CLASS, not RUNTIME: the annotation survives into your compiled bytecode so the scanner can read it, but adds no runtime dependency to your application.

Verifying it

A Declared record says a method is annotated. To also confirm it behaves as claimed, pair it with a @VerifiesControl test — same control id, a typed assertion, a Verified evidence record.

Usage

A GDPR example — annotating where consent gets recorded:

ConsentService.java

@ComplianceControl(
    id = "consent.capture",
    framework = "GDPR:Art.30"
)
public void recordConsent(String userId) {
    // your existing implementation
}

A SOC 2 example — annotating where a customer record is encrypted before it's persisted:

CustomerRepository.java

@ComplianceControl(
    id = "data.encryption.at-rest",
    framework = "SOC2:CC6.1"
)
public void persistCustomerRecord(CustomerRecord record) {
    // your existing implementation
}

What gets generated

Each annotated method produces one Declared evidence record at build time. See the evidence record schema for the full field-by-field breakdown, or the quickstart for the annotate-to-record walkthrough.