# Rule to check if data minimization principles are followed
violates_data_minimization {
  input.action.type == "collect"
  not data.required_fields[input.action.field]
}
```

This approach provides:

- Centralized policy management
- Consistent enforcement across services
- Automated testing of policies
- Clear audit trails

### Compliance-focused API testing

Automated testing designed for compliance can catch issues early.

```javascript
// Example Jest test for HIPAA compliance
describe('HIPAA Compliance Tests', () => {
  test('PHI is encrypted in transit', async () => {
    const response = await fetch('https://api.example.com/patient/123', {
      headers: { 'Authorization': 'Bearer test_token' }
    });
    
    // Check that the connection used TLS 1.2 or higher
    expect(response.connection.protocol).toMatch(/TLSv1\.[23]/);
  });
  
  test('Access logs are created for PHI access', async () => {
    await fetch('https://api.example.com/patient/123', {
      headers: { 'Authorization': 'Bearer test_token' }
    });
    
    // Check that access was logged
    const logs = await getAccessLogs();
    expect(logs).toContainEqual(expect.objectContaining({
      resource: '/patient/123',
      action: 'read',
      timestamp: expect.any(String),
      actor: expect.any(String)
    }));
  });
  
  test('Session expires after inactivity', async () => {
    // Get token
    const token = await getAuthToken();
    
    // Wait for token to expire
    await new Promise(resolve => setTimeout(resolve, 15 * 60 * 1000));
    
    // Try to use token after timeout
    const response = await fetch('https://api.example.com/patient/123', {
      headers: { 'Authorization': `Bearer ${token}` }
    });
    
    expect(response.status).toBe(401);
  });
});
```

Add tests to your CI/CD pipelines to prevent non-compliant code from reaching production, and to catch issues early in the development process.

### Data catalogs and classification

Modern data governance platforms like [Collibra](https://www.collibra.com/), [Alation](https://www.alation.com/), and [Atlan](https://atlan.com/) help track data lineage and enforce classification policies.

<Callout type="info" title="Data lineage">
  Data lineage is the process of tracking data from its origin to its destination. It helps organizations understand how data moves through their systems and ensures compliance with data handling policies.
</Callout>

Data catalogs are particularly useful in the modern AI-driven world, where data is often shared across multiple services and systems. By classifying data based on sensitivity and compliance requirements, you can ensure that only authorized services have access to sensitive data.

Aimed at data stewards and compliance officers, these platforms provide:

- Automated data discovery
- Data classification and tagging
- Data lineage tracking
- Compliance reporting

### Compliance scanning in CI/CD

Tools like [Snyk](https://snyk.io/), [Checkmarx](https://checkmarx.com/), and [SonarQube](https://www.sonarsource.com/products/sonarqube/) can be configured to scan for compliance issues during the build process:

```yaml