Method and System for Managing Regulation Requirement Control Graph State with AI Execution Control Event Integration

Abstract

The present invention relates to a method and system for managing AI compliance traceability that synchronizes the runtime execution status of an AI execution pipeline and the results of regulatory traceability queries in real time within a single graph data structure by receiving a judgment event issued from a policy enforcement module of an AI agent execution pipeline through an asynchronous message queue, updating the live_status of a Control node in a regulation-requirement-control three-layer semantic graph in real time using the control_id of the received event as a key, issuing an invalidation event to the aggregation cache (agg_status) of the connected Requirement node and Regulation node immediately upon completion of the update, recalculating the agg_status of the affected node in an asynchronous path separated from the user query processing path, and returning the enforcement status aggregation of the child Control node for forward queries containing a regulation identifier and the basis of the connected statutory provision for backward queries containing a control identifier from the same graph.

Description

Technology Field

[0001] The present invention relates to AI agent compliance management, and specifically, to a method and system that represents regulatory statutes, compliance requirements, and AI execution control items as a three-layer semantic graph data structure, synchronizes judgment events received from a policy enforcement point (PEP) enforcement engine with real-time state attributes of graph nodes, and provides bidirectional traceability from the statute provision level to the execution control enforcement state through forward and reverse search on the graph. Background Technology

[0002] As AI agent systems are introduced into high-risk sectors such as healthcare, finance, and the public sector, operating organizations face a compliance burden requiring simultaneous adherence to multiple regulations, including the Personal Information Protection Act, HIPAA, the EU AI Act, and the domestic Framework Act on AI. Current compliance management methods contain two major problems.

[0003] First is the limitation of the static checklist method. Existing policy management tools, such as Open Policy Agent (OPA) and XACML, represent policy rules in code or XML and evaluate them statically at the time of request. This approach does not provide the ability to track in real-time which statute requirements a specific control item is applied under, nor can it immediately verify whether a specific statute is currently being enforced by the AI ​​agent.

[0004] Second, there is a disconnect between the statutory layer and the technical layer. Cloud compliance tools such as AWS Security Hub and Microsoft Purview Compliance Manager provide mapping between regulatory frameworks (NIST, ISO 27001, etc.) and technical control items, but they fail to connect the enforcement results (Allow / Warn / Block / Error) generated in real-time by the Policy Enforcement Points (PEPs) of the AI ​​agent execution pipeline to that mapping. Consequently, to answer the question, "Is the PIPA Section 29 safeguard obligation currently being properly enforced by the AI ​​agent?", auditors must go through separate log inquiries, manual aggregation, and the creation of statutory-control cross-checks.

[0005] The present invention solves the two problems above on a single data structure by connecting regulatory laws, requirements, and control items in a three-layer semantic graph and reflecting the results of PEP execution in real time in the graph. Prior art literature

[0007] US Patent (US 10341410): Security tokens for a multi-tenant identity and data security management cloud service The problem to be solved

[0008] The technical problem that the present invention aims to solve is as follows.

[0009] It resolves the disconnect between the legal layer and the technology layer by connecting everything from the level of regulatory provisions to the execution status of the AI ​​agent's PEP using a single graph data structure.

[0010] When a specific regulatory provision is selected, it provides a forward search that immediately aggregates the current enforcement status of all control items required by that provision.

[0011] When a specific control item is selected, it provides a reverse search that immediately returns the higher-level requirements and statutory provisions requiring that control item.

[0012] By updating the execution status of graph nodes in real time through an asynchronous connection with the PEP execution engine, information delay between the audit time and the execution time is minimized.

[0013] By utilizing graph data structures, the relationships between multiple regulatory, requirement, and control items are visually represented, and the results of forward and reverse queries can be intuitively checked in the graph view. means of solving the problem

[0015] The present invention relates to a method for managing AI compliance traceability, comprising: (a) receiving a decision event issued from a policy enforcement module of an AI agent execution pipeline via an asynchronous message queue ― said decision event includes a control item identifier (control_id), a decision result (decision), a timestamp, an event identifier (event_id), and a policy enforcement stage identifier (source_pep_stage) ―; (b) querying a corresponding Control node in a three-layer semantic graph that includes an inclusion relationship edge (REGULATION_CONTAINS_REQUIREMENT) between a Regulation node and a Requirement node and an enforcement relationship edge (REQUIREMENT_ENFORCED_BY_CONTROL) between a Requirement node and a Control node, using the control item identifier as a key, and updating a real-time enforcement status attribute (live_status) and a synchronization timestamp (last_synced_at) of the corresponding Control node based on said decision result; (c) immediately upon completion of the live_status update, issuing an invalidation event for the aggregation cache (agg_status) of all Requirement nodes connected to the updated Control node via an execution relationship edge and Regulation nodes connected to the corresponding Requirement nodes via an inclusion relationship edge; and (d) in an asynchronous processing path separated from the user query processing path, recalculating the agg_status of the invalidated Requirement nodes and Regulation nodes by aggregating the live_status values ​​of the Control nodes connected to those nodes; comprising a regulation reflecting an AI execution control event. - requirements - It provides a control graph state management method.

[0016] In addition, the present invention is an AI compliance traceability management system comprising: a Regulation node representing regulatory statutes, a Requirement node representing individual compliance requirements, a Control node representing AI execution control items, a three-layer semantic graph storage unit storing inclusion relationship edges (REGULATION_CONTAINS_REQUIREMENT) between the Regulation node and the Requirement node, and enforcement relationship edges (REQUIREMENT_ENFORCED_BY_CONTROL) between the Requirement node and the Control node; a state synchronization module that receives a determination event via an asynchronous message queue from a policy enforcement module of an AI agent execution pipeline, updates the live_status attribute and last_synced_at of the corresponding Control node, and issues an invalidation event for the aggregation cache (agg_status) of the connected Requirement node and Regulation node immediately upon completion of the update; and a graph search engine that returns the live_status aggregation result of a child Control node for a forward query including a regulatory identifier, and returns connected statute provision information for a reverse query including a control item identifier. Regulation reflecting AI execution control events, comprising an aggregation cache manager that recalculates the agg_status of invalidated nodes as the live_status aggregate value of connected Control nodes in an asynchronous processing path separated from the user query processing path. - requirements - It provides a control graph state management system. Effects of the invention

[0017] The present invention exhibits the following effects.

[0018] 1) Reduction of synchronization delay between runtime state and query results: Minimizes the delay in reflecting the state between the time of AI agent execution and the compliance trace query results by receiving events based on an asynchronous message queue and immediately updating live_status.

[0019] 2) Improved processing efficiency through partial recalculation: By limiting the scope of aggregation cache invalidation to the Requirement and Regulation nodes directly connected to the updated Control node, query throughput is improved by selectively recalculating agg_status only on the affected nodes without rescanning the entire graph.

[0020] 3) Blocking query path delay: By performing agg_status recalculation in an asynchronous path separate from the user query processing path, the response delay of forward and reverse queries does not increase even when a large number of events occur.

[0021] 4) Reduction of duplicate query costs for multiple regulations: By connecting a single Control node to multiple Regulations through an N:M enforcement relationship edge structure, the legal basis of multiple regulations for the same control item is returned as a single reverse query, thereby eliminating duplicate query costs.

[0022] 5) Improved accuracy of state reflection compared to static tables: Conventional static regulation-control mapping tables rely on manual updates, which can result in inconsistencies with the state at runtime, whereas the present invention maintains consistency between the runtime state and trace data through event-driven live_status updates.

[0023] 6) Idempotency and delayed event consistency guarantee: By removing duplicate events based on event_id and reflecting the latest state based on timestamp, the consistency of the graph state is maintained even in the event of network retransmission or event order reversal. Brief explanation of the drawing

[0024] Figure 1 illustrates the three-tiered structure of the Regulation node, Requirement node, and Control node in the present invention, the edge relationships between each node, and the live_status attribute of the Control node. Figure 2 illustrates a processing flow that aggregates the execution status of the child Control node through forward search when a Regulation node is selected. Figure 3 illustrates a processing flow that returns the basis of a higher-level statute provision through reverse search when a Control node is selected. Figure 4 illustrates the flow in which the state synchronization module updates the live_status of the Control node through an asynchronous event queue from the PEP execution engine. Figure 5 illustrates the appearance and transition interface of an elliptical layout and a tree layout. Figure 6 illustrates the attribute schema and edge types of each of the Regulation, Requirement, and Control nodes. FIG. 7 illustrates the connection relationship between the main components constituting the present invention and external systems (policy enforcement module, external compliance profile generation system). Specific details for implementing the invention

[0025] The objects, specific advantages, and novel features of the present invention will become more apparent from the following detailed description and preferred embodiments in conjunction with the accompanying drawings. Additionally, the terms used are defined with respect to their functions in the present invention, which may vary according to the user's intent or practice. Therefore, the definitions of these terms should be based on the content throughout this specification.

[0027] First, the key terms used in the present invention are defined.

[0028] ■ Regulation Node ― An object abstracting applicable regulatory laws as graph nodes. It includes attributes such as regulation_id (PK), name, region, version, authority, and status (active / inactive), and is connected to one or more Requirement nodes via the REGULATION_CONTAINS_REQUIREMENT edge.

[0029] ■ Requirement Node ― An object that abstracts individual compliance requirements of a specific regulatory act into graph nodes. It includes attributes such as requirement_id (PK), code (e.g., PIPA-01), regulation_id (FK), article (article number), description, and risk_level (high / medium / low), and is connected to one or more Control nodes enforcing the requirement via the REQUIREMENT_ENFORCED_BY_CONTROL edge.

[0030] ■ Control Node ― An object abstracting a control item that enforces compliance requirements in the AI ​​agent execution pipeline as a graph node. It includes the attributes control_id (PK), code (e.g., CORE-ACC-01), requirement_ids (FK array), layer (Core / Extension), pep_stage (Ingress / Retrieval / Tool / Egress), live_status (normal / warning / failure), and last_synced_at.

[0031] ■ live_status ― A real-time status attribute of the Control node that is updated based on the judgment result received from the PEP execution engine via an asynchronous message queue. It has one of the values ​​normal, warning, or failure.

[0032] ■ Forward Traversal ― A graph traversal direction that aggregates the overall control enforcement status of a corresponding regulation by traversing from a specific Regulation node to a Requirement node along the REGULATION_CONTAINS_REQUIREMENT edge, followed by a Control node along the REQUIREMENT_ENFORCED_BY_CONTROL edge.

[0033] ■ Backward Traversal ― A graph traversal direction that returns the legal basis of the corresponding control item by traversing the Requirement node in reverse along the REQUIREMENT_ENFORCED_BY_CONTROL edge from a specific Control node, followed by the Regulation node in reverse along the REGULATION_CONTAINS_REQUIREMENT edge.

[0034] ■ Aggregation Cache ― A cache structure that stores forward search results (counts of normal / caution / failure control enforcement status by regulation) in the agg_status attribute of the Regulation node and Requirement node. After receiving a PEP event, the status synchronization module invalidates the cache of the relevant node.

[0035] The present invention is a regulation reflecting AI execution control events. - requirements - The control graph state management method and system is a system, and the system of the present invention consists of the following five core components.

[0036] . [Component A] 3-Layer Semantic Graph Store

[0037] . [Component B] State Synchronization Module

[0038] . [Component C] Graph Search Engine

[0039] . [Component D] Aggregate Cache Manager

[0040] . [Component E] Graph Visualization Module

[0041] The following describes these key components.

[0043] [Component A] 3-Layer Semantic Graph Store

[0044] As shown in Fig. 1, the graph storage unit stores and manages a directed graph composed of three node types and two edge types.

[0045] The Regulation node represents a regulatory statute and includes the attributes regulation_id(PK, UUID), name(statute name), region(applicable region), version, authority(responsible agency), status(active / inactive), and requirement_count(number of sub-Requirements, cache).

[0046] The Requirement node represents the individual requirements of a specific statute and includes the attributes requirement_id(PK, UUID), code(e.g., PIPA-01), regulation_id(FK), article(article number, e.g., Article 29), description, risk_level(high / medium / low), control_count(number of lower controls, cache), and agg_status(aggregate enforcement status, cache).

[0047] The Control node represents AI agent execution control items and includes attributes such as control_id (PK, UUID), code (e.g., CORE-ACC-01), requirement_ids (FK array, allowing multiple Requirement references), layer (Core / Extension), pep_stage (Ingress / Retrieval / Tool / Egress), live_status (normal / warning / failure), last_synced_at, allow_count_24h, warn_count_24h, and block_count_24h. In particular, live_status and last_synced_at are fields targeted for real-time synchronization with the PEP enforcement engine.

[0048] Edges are defined in two types. The REGULATION_CONTAINS_REQUIREMENT edge represents the inclusion relationship from a Regulation node to a Requirement node, and the REQUIREMENT_ENFORCED_BY_CONTROL edge represents the enforcement relationship from a Requirement node to a Control node. A single Control node can be connected to multiple Requirement nodes, which indicates that a single control item can satisfy multiple regulatory requirements simultaneously.

[0050] [Component B] State Synchronization Module

[0051] The state synchronization module subscribes to decision events issued by the policy enforcement module of the AI ​​agent execution pipeline via an asynchronous message queue (Async Event Queue), and updates live_status and last_synced_at by querying the corresponding Control node using the control_id included in the received event as the key. If the decision result is allow, live_status is set to normal; if it is warn, to warning; and if it is block or error, to failure. After the state update is complete, it publishes an aggregation cache invalidation event (agg_status) of the Requirement node and parent Regulation node connected to the corresponding Control node to the aggregation cache manager ([Component D]).

[0053] [Component C] Graph Search Engine

[0054] The graph traversal engine provides two modes: forward traversal and backward traversal.

[0055] Forward search is executed upon receiving a forward query containing a regulation identifier (regulation_id). Using the Breadth-First Search (BFS) algorithm, the list of child Requirement nodes is enumerated along the REGULATION_CONTAINS_REQUIREMENT edge, and then the list of Control nodes mapped to the corresponding Requirement is collected along the REQUIREMENT_ENFORCED_BY_CONTROL edge. The live_status of the collected Control nodes is aggregated to calculate the normal / caution / failure counts and ratios, and returned as a response.

[0056] Reverse search is performed when a reverse query containing a control item identifier (control_id) is received. It queries the connected Requirement nodes from the requirement_ids array of the Control node and queries the parent Regulation nodes through the regulation_id of each Requirement node. It returns the name and article information of the collected Regulation nodes as a list of legal provisions.

[0057] [Example 1] Forward Search — Specific Processing Flow

[0058] ■ Input: regulation_id = "REG-PIPA-2023" (Personal Information Protection Act node identifier)

[0059] ■ Processing: The graph search engine performs the following steps using the BFS algorithm. (Step 1) Traverse the REGULATION_CONTAINS_REQUIREMENT edge in the forward direction to enumerate 3 Requirement nodes: PIPA-01 (Article 29, Obligation to Take Safety Measures), PIPA-02 (Article 28-2, Pseudonymization), PIPA-03 (Article 39-3, Right to Portability of Personal Information) (Step 2) From each Requirement node, traverse the REQUIREMENT_ENFORCED_BY_CONTROL edge in the forward direction to collect a total of 7 Control nodes: CORE-ACC-01, CORE-LOG-01, CORE-ENC-01, CORE-ISO-01 (4 nodes belonging to PIPA-01), EXT-ANON-01 (1 node belonging to PIPA-02), EXT-PORT-01, EXT-PORT-02 (2 nodes belonging to PIPA-03) (Step 3) Aggregate the live_status of the 7 collected Control nodes.

[0060] ■ Output: { regulation_id: "REG-PIPA-2023", requirement_count: 3, control_count: 7, normal: 5, warning: 1, failure: 1, normal_ratio: 0714, warning_ratio: 0143, failure_ratio: 0143} This output is immediately displayed in the user interface as "Privacy Policy Act ― Normal 71% / Caution 14% / Failure 14%", enabling auditors to check the current enforcement status of a specific regulation with a single query.

[0062] [Example 2] Reverse Search ― Multi-regulatory Cross Return

[0063] ■ Input: control_id = "CORE-ACC-01" (Identifier of the Control node for access control policy enforcement), requirement_ids = ["PIPA-01", "AIB-03"] (Refer to multiple Requirements)

[0064] ■ Processing: (Step 1) Query the two Requirement nodes, PIPA-01 and AIB-03, from the requirement_ids array of the Control node CORE-ACC-01. (Step 2) Query the Regulation node "Personal Information Protection Act" using the regulation_id "REG-PIPA-2023" of PIPA-01, and query the Regulation node "AI Framework Act" using the regulation_id "REG-AIB-2024" of AIB-03. (Step 3) Extract the name of each Regulation node and the article (article number) of the corresponding Requirement node.

[0065] ■ Output: [ { regulation: "Personal Information Protection Act", article: "Article 29", requirement_code: "PIPA-01", description: "Duty of Safety Measures"}, { regulation: "Framework Act on AI", article: "Article 12", requirement_code: "AIB-03", description: "Duty to Ensure Transparency in AI Systems"} ] This output enables immediate verification that a single control item satisfies multiple regulatory laws simultaneously and provides the auditor with a legal basis through a single reverse search.

[0067] [Component D] Aggregate Cache Manager

[0068] When the aggregation cache manager receives a cache invalidation event from the state synchronization module, it recalculates and updates the agg_status of the affected Requirement and Regulation nodes. This recalculation is performed by aggregating the live_status (normal / caution / failure counts) of all Control nodes under the node in question. Cache invalidation and recalculation are performed as asynchronous processes separate from the user request processing path, so they do not affect search response latency.

[0070] [Component E] Graph Visualization Module

[0071] The graph visualization module renders node and edge data retrieved from the graph navigation API into an Ellipse or Tree layout. The Ellipse layout places regulation nodes at the center and sub-requirement and control nodes radially, making it advantageous for understanding the density of relationships between multiple nodes. The Tree layout vertically specifies the hierarchical structure of regulation → requirement → control, making it advantageous for identifying sub-aggregations of a single regulation. Both layouts switch instantly upon user interaction and share the same graph data. The node search function immediately focuses on the corresponding node using full-text search based on node name or code.

[0073] [Event Processing Structure and Consistency Management]

[0074] This section describes the event processing structure of the state synchronization module and the method for maintaining system consistency.

[0075] ■ Event Message Schema

[0076] The decision event published by the policy enforcement module to the asynchronous message queue includes the following fields: event_id (unique event identifier, UUID), control_id (identifier of the control item subject to the decision), decision (decision result: allow / warn / block / error), timestamp (time of decision occurrence, ISO 8601), source_pep_stage (PEP stage of decision occurrence: Ingress / Retrieval / Tool / Egress), tenant_id (multi-tenant identifier). This schema defines the minimum information required for the state synchronization module to query and update the correct Control node.

[0077] ■ Imperfect processing (Idempotent Processing)

[0078] Duplicate determination events with the same event_id may be received due to network retransmission or the at-least-once delivery guarantee of message queues. The state synchronization module stores processed event_ids in a short-term cache (TTL: 24 hours) and skips updating the live_status and issuing cache invalidation events if the event_id of a received event exists in the cache. This prevents distortion of the agg_status caused by duplicate processing of the same event.

[0079] ■ Delayed arrival event handling

[0080] Older decision events may arrive later than newer events due to network latency or queue processing reversal. The state synchronization module compares the timestamp of a received event with the last_synced_at of the corresponding Control node; if the timestamp of the received event is earlier than last_synced_at, it skips updating the live_status. This ensures that the latest execution results are maintained in the graph even in situations where event order is reversed.

[0081] ■ Cache invalidation propagation range

[0082] Cache invalidation propagation is limited to Requirement nodes directly connected to the updated Control node and Regulation nodes directly connected to those Requirement nodes. The agg_status of Regulation nodes and Requirement nodes of unconnected regulations are not affected. This scope limitation minimizes system load by ensuring that a single Control node state change does not trigger a full graph recalculation. In an N:M connected structure, all Requirement nodes listed in the corresponding Control node's requirement_ids array are included in the invalidation target.

[0083] ■ Fallback processing in case of synchronization failure and queue backlog

[0084] In the event of a transient failure or processing backlog in the asynchronous message queue, the state synchronization module maintains the last successfully updated live_status value. The graph traversal engine responds to forward and backward queries based on the cached agg_status value or the most recently synchronized live_status, even during periods of queue failure. Control nodes with an abnormally old last_synced_at attribute are notified in the query results via a stale flag.

[0085] ■ Removing duplicates during reverse search

[0086] In an N:M structure, if a single Control node is connected to multiple Requirement nodes and those Requirement nodes reference the same Regulation node, the reverse search manages the visited Regulation nodes as a Set data structure to return a unique list of legal provisions without duplicates. Similarly, during a forward search, if the same Control node is traversed through multiple Requirement nodes, the Control node's live_status is included in the aggregation count only once.

[0088] Embodiments of the present invention include a computer-readable medium comprising program instructions for performing operations implemented by various computers. This medium records a program for executing the method described above. This medium may include program instructions, data files, data structures, etc., either alone or in combination. Examples of such media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CDs and DVDs; floptical disks and magneto-optical media; and hardware devices configured to store and execute program instructions, such as ROM, RAM, and flash memory. Examples of program instructions include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

[0089] Although preferred embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements by those skilled in the art using the basic concept of the present invention as defined in the following claims also fall within the scope of the present invention.

Claims

Claim 1 A method for managing the state of a regulation-requirement-control graph reflecting AI execution control events, comprising: (a) receiving a decision event issued from a policy enforcement module of an AI agent execution pipeline via an asynchronous message queue ― said decision event includes a control item identifier (control_id), a decision result (decision), a timestamp (timestamp), an event identifier (event_id), and a policy enforcement stage identifier (source_pep_stage) ―; (b) querying a corresponding Control node in a three-layer semantic graph containing an inclusion relationship edge (REGULATION_CONTAINS_REQUIREMENT) between a Regulation node and a Requirement node and an enforcement relationship edge (REQUIREMENT_ENFORCED_BY_CONTROL) between a Requirement node and a Control node, using said control item identifier as a key, and updating the live enforcement status attribute (live_status) and synchronization timestamp (last_synced_at) of the corresponding Control node based on said decision result; (c) immediately upon completion of the live_status update, issuing an invalidation event for the aggregation cache (agg_status) of all Requirement nodes connected to the updated Control node via an execution relationship edge and Regulation nodes connected to the Requirement nodes via an inclusion relationship edge; and (d) in an asynchronous processing path separated from the user query processing path, recalculating the agg_status of the invalidated Requirement nodes and Regulation nodes by aggregating the live_status values ​​of the Control nodes connected to the nodes; comprising a regulation-requirement-control graph state management method reflecting AI execution control events. Claim 2 In claim 1, the step (b) comprises a judgment result mapping step of setting live_status to normal if the received judgment result is allow, to warning if it is warn, and to failure if it is block or error, a regulation reflecting an AI execution control event. - requirements - Control graph state management method. Claim 3 The regulation reflecting an AI execution control event according to claim 1, wherein step (a) further comprises an idempotent processing step of identifying duplicate events by comparing the event_id of a received judgment event with a list of pre-processed events, and omitting the live_status update and cache invalidation event issuance for events confirmed as duplicates. - requirements - Control graph state management method. Claim 4 In claim 1, the step (b) further comprises a delayed event processing step of omitting the update of live_status if the timestamp of the received determination event is earlier than last_synced_at of the corresponding Control node, and performing the update only if the timestamp is later than last_synced_at, in a regulation reflecting an AI execution control event. - requirements - Control graph state management method. Claim 5 In claim 1, the scope of the invalidation event issuance in step (c) is limited to Requirement nodes directly connected to the updated Control node via an execution relationship edge and Regulation nodes directly connected to the Requirement node via an inclusion relationship edge, and the cache of unconnected nodes is not invalidated, a regulation reflecting an AI execution control event. - requirements - Control graph state management method. Claim 6 In claim 1, the three-layer semantic graph supports a many-to-many (N:M) structure in which a single Control node is connected to a plurality of Requirement nodes via execution relationship edges, and the Requirement node subject to the invalidation event issuance in step (c) includes all Requirement nodes listed in the requirement_ids array of the corresponding Control node, thereby reflecting a regulation of AI execution control events. - requirements - Control graph state management method. Claim 7 The regulation reflecting an AI execution control event according to claim 1, wherein step (b) further comprises a fallback processing step that, in the event of a backlog or transient failure of the asynchronous message queue, maintains the last successfully synchronized live_status value and provides the cached value for the agg_status recalculation. - requirements - Control graph state management method. Claim 8 For a 3-layer semantic graph in which the real-time execution status attribute (live_status) of a Control node is updated based on the judgment result of a judgment event received from a policy enforcement module of an AI agent execution pipeline via an asynchronous message queue, wherein the judgment result is one of allow, warn, block, or error, and the live_status is set to normal if the judgment result is allow, to warning if it is warn, and to failure if it is block or error, the computer system comprises: (a) a forward search step in which, upon receiving a forward query including a regulation identifier (regulation_id), enumerates Requirement nodes along the inclusion relationship edge (REGULATION_CONTAINS_REQUIREMENT) from a Regulation node corresponding to the regulation identifier, collects Control nodes along the enforcement relationship edge (REQUIREMENT_ENFORCED_BY_CONTROL) from each Requirement node, aggregates the live_status of the collected Control nodes, and returns the result; and (b) a reverse search step of, upon receiving a reverse query including a control item identifier (control_id), querying a connected Requirement node in an array of control requirement identifiers (requirement_ids) of a Control node corresponding to the control item identifier, querying a parent Regulation node through the regulation identifier (regulation_id) of each Requirement node, and returning the name and article number information of the Regulation node; comprising a method for managing the state of a regulation-requirement-control graph reflecting an AI execution control event. Claim 9 In claim 8, the aggregation result of step (a) includes a regulatory identifier, a total number of child Control nodes (control_count), counts by live_status (normal_count, warning_count, failure_count), and respective ratios, wherein the forward search is a regulation reflecting an AI execution control event that first references an aggregate cache (agg_status) value recalculated in an asynchronous path separated from the user query processing path. - requirements - Control graph state management method. Claim 10 In claim 8, the step (b) is a regulation reflecting an AI execution control event that, when a single Control node is connected to multiple Requirement nodes, enumerates the parent Regulation nodes of all connected Requirement nodes without duplication and simultaneously returns multiple legal provisions as a single reverse query response. - requirements - Control graph state management method. Claim 11 In claim 8, the Control node comprises, as attributes, a policy enforcement stage (pep_stage: one of Ingress, Retrieval, Tool, Egress) on which the control item is deployed, a policy layer (layer: Core or Extension), a synchronization timestamp (last_synced_at), and counts per judgment result based on the previous 24 hours (allow_count_24h, warn_count_24h, block_count_24h), a regulation reflecting an AI execution control event. - requirements - Control graph state management method. Claim 12 As a regulation-requirement-control graph state management system reflecting AI execution control events, a 3-layer semantic graph store storing Regulation nodes representing regulatory statutes, Requirement nodes representing individual compliance requirements, Control nodes representing AI execution control items, inclusion relationship edges (REGULATION_CONTAINS_REQUIREMENT) between Regulation nodes and Requirement nodes, and enforcement relationship edges (REQUIREMENT_ENFORCED_BY_CONTROL) between Requirement nodes and Control nodes; a state synchronization module that receives a determination event via an asynchronous message queue from a policy enforcement module of an AI agent execution pipeline, updates the live_status attribute and last_synced_at of the corresponding Control node, and issues an invalidation event for the aggregation cache (agg_status) of the connected Requirement and Regulation nodes immediately upon completion of the update; and a graph traversal engine that returns the live_status aggregation result of a child Control node for a forward query containing a regulatory identifier, and returns connected statute provision information for a backward query containing a control item identifier. A regulation-requirement-control graph state management system reflecting AI execution control events, comprising: an aggregation cache manager that recalculates the agg_status of invalidated nodes as the live_status aggregate value of connected Control nodes in an asynchronous processing path separated from the user query processing path. Claim 13 In claim 12, the state synchronization module performs idempotent processing by comparing the event_id of a received decision event with a list of pre-processed events to omit updates for duplicate events, omits updates if the timestamp of the received decision event is earlier than the last_synced_at of the corresponding Control node, and sets the live_status by mapping the decision result to allow as normal, warn as warning, and block or error as failure, a regulation reflecting an AI execution control event. - requirements - Control graph state management system. Claim 14 In claim 12, the three-layer semantic graph storage unit stores many-to-many (N:M) enforcement relationship edges in which a single Control node is connected to a plurality of Requirement nodes, and the reverse query processing of the graph search engine simultaneously returns legal provision information of multiple regulations connected to a single Control node without duplication, a regulation reflecting an AI execution control event. - requirements - Control graph state management system. Claim 15 A non-transient computer-readable storage medium storing instructions that perform AI compliance traceability management operations when executed by one or more processors, wherein the operations include: receiving a determination event through an asynchronous message queue from a policy enforcement module of an AI agent execution pipeline; querying a corresponding Control node in a 3-layer semantic graph using a control item identifier of the received determination event as a key and updating live_status; issuing an invalidation event for the aggregation cache (agg_status) of the connected Requirement node and Regulation node immediately upon completion of the live_status update; recalculating the agg_status of the invalidated node in an asynchronous processing path separated from the user query processing path; returning the live_status aggregation result of the child Control node for a forward query including a regulation identifier; and returning connected statutory provision information for a reverse query including a control item identifier. Claim 16 A non-transient computer-readable storage medium according to claim 15, wherein the operation further comprises: an event_id-based idempotent processing operation of a received decision event; an operation of comparing the timestamp of a received decision event with last_synced_at to reflect only the latest event; and an operation of limiting the cache invalidation propagation range to Requirement and Regulation nodes directly connected to the updated Control node.

Images