Compliance Constraints Filter Entry Point Options First

Compliance comes first, before any technical decision

The single most important sequencing rule in enterprise integration is that compliance filters the options before anything else. Regulatory and policy constraints, BAA coverage for health data, FedRAMP authorisation for government workloads, data-residency pinning for regional requirements, approved-vendor lists, eliminate entry point options before any other integration decision is made. You do not pick a technically appealing entry point and then check whether it is compliant; you first determine which entry points are even permissible under the governing constraint, and only choose among the survivors. The exam treats getting this order right as its own understand-level skill.

The reason the order matters is that compliance is a hard gate, not a preference. A technically perfect integration on a non-compliant entry point is not a viable integration; it is a design that will be stopped at legal or security review, wasting everything built on it. Filtering first prevents that.

The correct sequence

The procedure is explicit and ordered. First, identify the governing constraint: what regulation or policy actually applies to this workload and its data? Second, determine which entry points survive that constraint: given the constraint, which of the available entry points are permissible? Third, choose the integration pattern within that surviving set, using the technical trade-offs, flexibility, reuse, maintenance, to pick among the options that are already known to be compliant. The technical decision happens last, inside the boundary that compliance has already drawn.

This ordering is what keeps the technical reasoning from ever proposing something that compliance would forbid. By the time you weigh a direct API against an MCP server, both are already on the compliant list, so whichever you pick will survive review. Reverse the order, choose technically first, and you risk landing outside the compliant set and only discovering it later.

The named routes each constraint leaves standing

Knowing which routes survive a given constraint is what turns the sequencing rule into a usable filter. A crucial subtlety: a Business Associate Agreement (BAA) is configuration-specific, not provider-general. The same surface can be covered on one delivery route and uncovered on another, so coverage is verified by exact configuration rather than by product name. For PHI under HIPAA, the eligible paths are the Claude API directly with a signed BAA from Anthropic, AWS Bedrock, and Google Vertex AI. For government and FedRAMP workloads, the authorised paths are Claude for Government, AWS Bedrock GovCloud, and Google Vertex Assured Workloads; Claude Enterprise on the direct API is not FedRAMP authorised and cannot stand in for one of these.

Data-residency and GDPR constraints pin model execution to an approved region, achieved through a cloud route (Bedrock or Vertex) or through the direct API's inference_geo parameter, which currently accepts values for the US and for global routing but does not offer direct EU pinning. Where a deployment carries a hard EU residency requirement, a cloud route is the correct choice rather than the direct API. The residency pin is set at the integration layer and checked on every request, never assumed from the entry point alone.

Skipping the filter, and the "applies equally" error

Two errors follow from mishandling the sequence. The first is choosing an entry point for technical convenience first and checking compliance afterwards. This is the ordering inverted, and it is dangerous precisely because the technical choice can look excellent right up until a compliance review rejects the entry point it sits on, at which point the redesign cost is everything already invested. Compliance-after is compliance-too-late.

The second is assuming a compliance constraint applies equally to every entry point rather than eliminating specific ones. Constraints are selective: a given constraint may rule out some entry points while leaving others perfectly viable. Treating a constraint as either irrelevant or as blocking everything both miss the actual task, which is to work out precisely which entry points it eliminates and which survive. The whole value of the filter is that it narrows the set to the permissible ones, and that requires reasoning about the constraint's specific effect on each option. This is what the regulatory-constraint selection capstone exercises directly.

What the exam trips candidates on

Two traps. The first is choosing an entry point for technical convenience first and checking compliance afterwards, which inverts the sequence and risks building on a non-compliant foundation. The second is assuming a compliance constraint applies equally to every entry point rather than eliminating specific ones, missing that the task is to identify precisely which survive. The credited answer filters by compliance first, then chooses technically within the surviving set.

Common misreadings to avoid

How this shows up on the exam

Expect a regulated workload where an entry point is chosen technically first, or where a constraint is treated as all-or-nothing. The reliable reading is the sequence: governing constraint, surviving entry points, then technical choice within the survivors. This knowledge point builds on integration entry point options, shares its compliance-first gate with batch processing for regulated data, relates to the direct-API-versus-MCP trade-off, and unlocks the regulatory-constraint selection capstone.