Regulatory Source Crosswalk

Every automated decision this site’s pipelines make about a tower — reject a lease, quarantine a record, grant a role read access, clear a technician to climb — is only as defensible as the statute it can point back to. The Regulatory Source Crosswalk is the lookup that makes that pointing-back possible: a deterministic, one-directional map from every canonical field and access control this platform touches to the exact regulatory source that governs it, the citation an auditor can verify, and the obligation that citation imposes. It is one of the three subsystems anchoring the Telecom Compliance Data Reference, sitting alongside the field vocabulary and the audit ledger it feeds. Where a field dictionary answers “what does tower_height_ft mean,” the crosswalk answers a different and equally load-bearing question: “which regulation requires us to track it, and what happens if we can’t answer that.” For tower lease managers and municipal compliance teams, an unanchored field is not a cosmetic gap — it is a decision with no defense behind it.

The Core Challenge #

Consider a compliance export generated for a municipal audit of a 40-site portfolio. The export lists fcc_asr_number, tower_height_ft, landlord_id, and a dozen other fields, each with a value, and the auditor asks the obvious question: under what authority is each of these tracked, and what happens if one is missing? For fcc_asr_number the answer is immediate — the Federal Communications Commission requires an Antenna Structure Registration under 47 CFR Part 17 before a structure of qualifying height is built, and the number is the proof. For a field like landlord_id, the answer is less obvious to anyone who has not read NIST SP 800-53’s access-control family, but it is no less real: the field carries personally identifying information about a private landlord, and federal information-security guidance requires that access to it be gated by role, not by convenience. If the engineer who built the export cannot answer both questions for every field on the page, the export is not a compliance artifact — it is a spreadsheet that happens to look like one.

This is the failure mode a crosswalk exists to close, and it rarely appears as a hard error. A new field gets added to a vendor feed — say, a technician’s fall-protection certification date — and it flows cleanly through ingestion, validation, and storage because none of those gates check for a regulatory anchor; they check for type and range. The field sits in production for a year, fully functional, entirely unaudited, until an OSHA inspector asks which certification governs it and the answer is “we’re not sure, but we do track the date.” A crosswalk turns that silence into a loud, immediate flag: a field with no entry in the registry is not just undocumented, it is surfaced at resolution time as a field lacking a regulatory anchor, before it ever reaches an audit binder. The registry is deliberately narrow in scope — it does not validate values, the way the Canonical Field Dictionary does, and it does not seal records, the way the audit ledger does. It answers exactly one question, for exactly one field at a time: which statute, if any, is the reason this field exists.

Data Model & Schema #

The canonical unit is the RegulatoryMapping: a small, immutable record that ties one subject — a canonical field name or an access-control identifier — to the source that governs it, a verifiable citation, the plain-text obligation the citation imposes, and a severity that tells a downstream consumer how urgently a missing anchor should be treated. Immutability matters here for the same reason it matters in a LeaseRecord: a crosswalk entry that could be edited in place by a caller would stop being a source of truth and start being a suggestion.

As a dataclass, the record validates its own citation grammar and severity vocabulary at construction time, so a malformed entry cannot enter the registry silently — it fails the moment someone tries to register it, not the first time a downstream consumer happens to read it:

import re
from dataclasses import dataclass

_CITATION_PATTERN = re.compile(
    r"^(47 CFR § \d+(\.\d+)?|NIST SP 800-53 [A-Z]{2}-\d+|29 CFR § \d+(\.\d+)?)$"
)


class CrosswalkError(Exception):
    """Raised when a crosswalk entry or resolution request is invalid."""


@dataclass(frozen=True)
class RegulatoryMapping:
    subject: str
    source: str
    citation: str
    obligation: str
    severity: str

    def __post_init__(self) -> None:
        if not _CITATION_PATTERN.match(self.citation):
            raise CrosswalkError(f"malformed citation for '{self.subject}': {self.citation}")
        if self.severity not in {"CRITICAL", "HIGH", "ADVISORY"}:
            raise CrosswalkError(f"unknown severity for '{self.subject}': {self.severity}")

ADVISORY covers subjects like structure_type, where the FCC citation informs which marking and lighting schedule applies but is not itself grounds to reject a record. CRITICAL is reserved for subjects where a missing or invalid anchor should block a downstream action outright — an unregistered structure, or a technician cleared to climb without a certification on file.

Algorithmic or Architectural Approach #

The approach is a crosswalk registry: a flat dictionary keyed by subject name, mapping directly to its RegulatoryMapping. The design choice that matters is what the registry deliberately is not — it is not a rule engine, it does not evaluate conditions, and it does not know anything about a specific tower. It is a lookup table, and its entire value comes from being exhaustive and current. A resolver walks a canonical record’s fields, looks each one up, and partitions the result into two buckets: fields that resolved to a citation, and fields that did not. The second bucket is the point of the whole exercise — every unanchored field it surfaces is either a subject that needs to be added to the registry, or a field that has no business existing in a compliance record at all.

The matrix below shows the crosswalk registry’s current coverage: canonical fields and access-control identifiers as rows, the three governing sources as columns. A filled dot marks a subject with an entry in that source’s citation family; the rightmost Anchor column marks whether the subject resolves to any citation at all. rent_amount_usd is included deliberately, unmarked in every column — it is a commercial field with no regulatory citation behind it, and the matrix shows that absence exactly as loudly as it shows a present mapping.

Figure: six fields resolve to a governing source and a rightmost anchor check; rent_amount_usd resolves to none and is flagged.

Validation & Compliance Gates #

The crosswalk itself does not gate records — it informs the gates elsewhere. Each registry entry contributes its severity to whatever pipeline calls the resolver, so that a CRITICAL unanchored subject can be wired to block downstream processing while an ADVISORY gap only logs. Two properties are enforced at the registry layer, before any record is ever resolved against it. First, every citation string must match the grammar for its source family — 47 CFR § <part>.<section> for FCC ASR, NIST SP 800-53 <family>-<number> for NIST controls, 29 CFR § <part>.<section> for OSHA — because a citation an auditor cannot independently look up is worse than no citation at all; it invites the assumption of authority without the substance. Second, every entry’s severity must belong to the fixed three-value vocabulary, since a resolver that has to special-case an unrecognized severity string at runtime has already lost the property that made the registry trustworthy: that every entry means exactly one of a small, known set of things.

Resolution against a record produces no side effects beyond structured log lines — the resolver never mutates the record it is given, and it never rejects a record outright. That restraint is deliberate: whether an unanchored CRITICAL field should halt a pipeline is a decision that belongs to the caller, not to the crosswalk, because the same field might be acceptable in a draft record and unacceptable in one about to be exported for a municipal audit. The one condition the resolver does refuse outright is an empty record, since there is nothing to crosswalk and returning an empty, successful result would silently mask a caller bug further upstream.

Integration Points #

The crosswalk sits between two other reference subsystems and depends on both staying synchronized with it. The Canonical Field Dictionary defines what each field is — its type, unit, and constraint — and the crosswalk assumes every subject key it registers already exists in that dictionary; a crosswalk entry for a field the dictionary has never heard of is itself a bug, not a feature. Every resolution the crosswalk performs is written as a structured log line specifically so it can be consumed by the Audit Log Schema Reference, which defines the sealed, tamper-evident shape those log lines are folded into; the crosswalk supplies the why behind an audit entry, and the ledger schema supplies the how it’s proven unaltered.

Two task walk-throughs extend this page into concrete implementation detail. Validating FCC ASR numbers in Python shows the format and check-digit rules an fcc_asr_number value must satisfy before it is trustworthy enough to anchor to 47 CFR Part 17 at all — the crosswalk assumes the number is well-formed, and that page is where well-formedness is actually enforced. Mapping NIST SP 800-53 controls to tower data access goes deeper into the access-control family this page only summarizes, walking through how AC and AU controls translate into concrete role definitions for fields like landlord_id. Both pages depend on the registry defined here; this page does not depend on either of them.

Python Implementation #

The module below is the runnable resolver: it holds the crosswalk registry, resolves a canonical record’s fields against it, flags any field lacking a regulatory anchor instead of silently dropping it, and seals the set of matched citations with a SHA-256 digest so a downstream audit consumer can verify the exact set of citations a record was resolved against without re-running the resolution.

import hashlib
import json
import logging
import re
from dataclasses import dataclass
from typing import Any, Optional

logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s | %(levelname)s | %(name)s | %(message)s",
)
logger = logging.getLogger("regulatory_crosswalk")

_CITATION_PATTERN = re.compile(
    r"^(47 CFR § \d+(\.\d+)?|NIST SP 800-53 [A-Z]{2}-\d+|29 CFR § \d+(\.\d+)?)$"
)


class CrosswalkError(Exception):
    """Raised when a crosswalk entry or a resolution request is invalid."""


@dataclass(frozen=True)
class RegulatoryMapping:
    subject: str
    source: str
    citation: str
    obligation: str
    severity: str

    def __post_init__(self) -> None:
        if not _CITATION_PATTERN.match(self.citation):
            raise CrosswalkError(f"malformed citation for '{self.subject}': {self.citation}")
        if self.severity not in {"CRITICAL", "HIGH", "ADVISORY"}:
            raise CrosswalkError(f"unknown severity for '{self.subject}': {self.severity}")


CROSSWALK_REGISTRY: dict[str, RegulatoryMapping] = {
    "fcc_asr_number": RegulatoryMapping(
        "fcc_asr_number", "FCC_ASR", "47 CFR § 17.4",
        "Structure must carry an assigned Antenna Structure Registration before construction.",
        "CRITICAL"),
    "tower_height_ft": RegulatoryMapping(
        "tower_height_ft", "FCC_ASR", "47 CFR § 17.7",
        "Height above ground level sets registration, marking, and lighting obligations.",
        "CRITICAL"),
    "structure_type": RegulatoryMapping(
        "structure_type", "FCC_ASR", "47 CFR § 17.21",
        "Structure classification determines which marking and lighting schedule applies.",
        "ADVISORY"),
    "landlord_id": RegulatoryMapping(
        "landlord_id", "NIST_800_53", "NIST SP 800-53 AC-3",
        "Access to landlord identity and lease PII must be enforced by role-based authorization.",
        "HIGH"),
    "ledger_integrity_hash": RegulatoryMapping(
        "ledger_integrity_hash", "NIST_800_53", "NIST SP 800-53 AU-10",
        "Compliance records must carry non-repudiable, tamper-evident integrity evidence.",
        "HIGH"),
    "fall_protection_cert": RegulatoryMapping(
        "fall_protection_cert", "OSHA_1926", "29 CFR § 1926.1420",
        "Personnel ascending a structure must hold a current fall-protection certification.",
        "CRITICAL"),
}


class CrosswalkResolver:
    def __init__(self, registry: Optional[dict[str, RegulatoryMapping]] = None) -> None:
        self._registry = registry or CROSSWALK_REGISTRY

    def resolve(self, record: dict[str, Any]) -> dict[str, Any]:
        if not record:
            raise CrosswalkError("cannot resolve an empty record")
        matched: list[RegulatoryMapping] = []
        unanchored: list[str] = []
        for field_name in record:
            mapping = self._registry.get(field_name)
            if mapping is None:
                unanchored.append(field_name)
                logger.warning("AUDIT | field=%s | NO_REGULATORY_ANCHOR", field_name)
            else:
                matched.append(mapping)
                logger.info(
                    "AUDIT | field=%s | %s | %s | severity=%s",
                    mapping.subject, mapping.source, mapping.citation, mapping.severity,
                )
        return {
            "matched": matched,
            "unanchored": sorted(unanchored),
            "seal": self._seal(matched),
        }

    @staticmethod
    def _seal(matched: list["RegulatoryMapping"]) -> str:
        canonical = json.dumps(
            [{"subject": m.subject, "citation": m.citation, "severity": m.severity} for m in matched],
            sort_keys=True, separators=(",", ":"),
        )
        return hashlib.sha256(canonical.encode("utf-8")).hexdigest()


if __name__ == "__main__":
    record = {
        "site_id": "TWR-8842",
        "fcc_asr_number": "1290123",
        "tower_height_ft": 285.0,
        "landlord_id": "LL-30291",
        "ledger_integrity_hash": "9f8c2ae0b1d4",
        "rent_amount_usd": 4200.0,
    }
    result = CrosswalkResolver().resolve(record)
    for mapping in result["matched"]:
        print(f"[{mapping.severity}] {mapping.subject} -> {mapping.citation}")
    print("unanchored:", result["unanchored"])
    print("seal:", result["seal"][:12])

Testing & Verification #

A crosswalk fails silently if the wrong thing is tested — asserting that a resolver returns something proves far less than asserting it returns the exact citation a specific subject requires, and that a subject with no registry entry is surfaced rather than swallowed. The stubs below use pytest and target the resolver module as crosswalk:

import pytest
from crosswalk import CrosswalkResolver, CrosswalkError, RegulatoryMapping

def test_known_field_resolves_to_its_citation():
    result = CrosswalkResolver().resolve({"fcc_asr_number": "1290123"})
    assert result["matched"][0].citation == "47 CFR § 17.4"
    assert result["unanchored"] == []

def test_unmapped_field_is_flagged_not_dropped():
    result = CrosswalkResolver().resolve({"rent_amount_usd": 4200.0})
    assert result["matched"] == []
    assert result["unanchored"] == ["rent_amount_usd"]

def test_seal_depends_on_subject_set_not_values():
    r1 = CrosswalkResolver().resolve({"tower_height_ft": 285.0})
    r2 = CrosswalkResolver().resolve({"tower_height_ft": 300.0})
    assert r1["seal"] == r2["seal"]

def test_empty_record_raises():
    with pytest.raises(CrosswalkError):
        CrosswalkResolver().resolve({})

def test_malformed_citation_rejected_at_construction():
    with pytest.raises(CrosswalkError):
        RegulatoryMapping("x", "FCC_ASR", "not-a-citation", "some obligation", "CRITICAL")

Running the __main__ demo against a record that mixes four anchored fields, one unanchored commercial field, and one identifier the registry has no opinion about produces:

[CRITICAL] fcc_asr_number -> 47 CFR § 17.4
[CRITICAL] tower_height_ft -> 47 CFR § 17.7
[HIGH] landlord_id -> NIST SP 800-53 AC-3
[HIGH] ledger_integrity_hash -> NIST SP 800-53 AU-10
unanchored: ['rent_amount_usd', 'site_id']
seal: 5b8f2d417a09

A resolver that returns an empty unanchored list for a record containing rent_amount_usd has a bug in its lookup, not a clean registry — the field genuinely has no citation, and the test suite pins that as an expected outcome rather than an error to eventually fix.

Operational Considerations #

Statute versioning is the crosswalk’s most persistent maintenance burden. A citation like 47 CFR § 17.7 is not a static string — 47 CFR Part 17 has been amended, and a registry entry that quotes a subsection number without a review date will drift silently out of correctness while continuing to pass every structural test in this page, because the tests check the shape of a citation, not whether it is still current. Production registries should carry a last_reviewed timestamp per entry, external to the RegulatoryMapping itself, and a scheduled job that flags any entry older than a fixed review interval — six months is a reasonable default for FCC rules, twelve for NIST SP 800-53 revisions, which move more slowly.

Multi-jurisdiction overlap complicates the otherwise clean one-subject-to-one-source model this page presents. A field like tower_height_ft is federally anchored to FCC ASR, but a municipality can layer its own ordinance on top of the same field, and that local rule does not replace the federal citation — it adds to it. A registry that only supports one RegulatoryMapping per subject will eventually need to support a list, keyed additionally by jurisdiction_code, the same way Lease Taxonomy Standardization scopes its bounds gates per jurisdiction rather than applying one global constant. Resist the temptation to solve this by concatenating citations into one string; a jurisdiction-scoped list keeps each citation independently verifiable and independently versioned.

Severity is a routing signal, not a validation outcome. It is tempting to have the resolver itself reject records containing an unanchored CRITICAL subject, but that couples a general-purpose lookup to one specific caller’s risk tolerance. A draft record mid-ingestion may legitimately carry an unanchored field that will be resolved before it reaches an export; a resolver that raises on every CRITICAL gap would make iterative data entry impossible. Leave the escalation decision — block, warn, or log — to the pipeline stage that owns the record’s lifecycle, and let the crosswalk do exactly one job: tell the truth about what governs each field, and admit plainly when nothing does.

FAQ #

Related #

• Up to the parent architecture: Telecom Compliance Data Reference
• Sibling reference: Canonical Field Dictionary
• Sibling reference: Audit Log Schema Reference
• Task walk-through: Validating FCC ASR numbers in Python
• Task walk-through: Mapping NIST SP 800-53 controls to tower data access