Compliance & MNPI
MNPI gates that survive real desks—not slide-deck theater
If the compliant path is slower for twelve straight months, your firm does not have a wall—it has a speed bump people drive around. Durable MNPI programs encode routing and logging so the safe choice is also the lazy choice under pressure. This note is not legal advice; it is what good operators build after counsel explains the bright lines: attribution that survives memory, UX that blocks accidents, and drills that treat an allow on the wrong object as a Sev-1.
Why posters fail
People optimize for getting work done before the bell. If the compliant route is three clicks slower for a year, the firm tacitly selects the fast route—then feigns surprise in review.
Leadership signals matter: when principals visibly bypass controls for convenience, juniors learn the control is decorative. Fix entitlement UX before you moralize about ‘culture.’
Technical patterns that help
Separate workspaces or hosts per side of the wall; shared calculators only where policy allows and with audited inputs. Session banners that state context in the chrome, not only in email disclaimers.
Prefer deny-by-default data APIs keyed to workspace+role; URL obscurity alone fails the moment someone emails a link.
Engineering invariant: no object should be readable without an entitlement check on every request—cached HTML included.
Switching contexts
When users change hats, record the switch as an event: who, when, from which workspace to which, and whether material documents moved. Ambiguity here is where investigations start.
Pair switches with short UI friction on first login after swap—‘confirm side’ beats silent context drift.
Rotational programs and coverage desks multiply switches; design for volume, not for static org charts.
Research vs banking vs public side
Names differ by regulator and firm; the engineering invariant is: entitlements follow identity + workspace + object, not URL obfuscation alone.
Marketing hosts must not echo entitlements or tenant topology; see the public-surface note in this series for crawler discipline.
Communications hygiene
Pre-fill subject lines with workspace tags where mail crosses teams. Block paste from restricted contexts into public marketing chrome when technically feasible—guardrails beat reminders.
Chat tools inherit weakness: bot integrations that mirror channels can amplify cross-wall leaks—review connectors with the same paranoia as VPN access.
Incidents and self-reporting
Make ‘I almost crossed’ easy to file without shame; small near-misses are data for UX fixes. Big misses need legal involvement immediately—engineers should not improvise counsel.
Run blameless postmortems that still produce concrete controls: if root cause is ‘human error,’ ask what affordance failed.
Vendor and third-party research
Expert networks and bespoke datasets need tags in lineage feeds: who can see outputs, under what subscription terms, and what re-distribution is barred.
When models summarize third-party text, retention of prompts and outputs may implicate client NDAs—route with policy flags, not with vibes.
Testing the wall
Quarterly: attempt forbidden reads with test accounts—expect deny. If you get allow, that is not a false positive; that is a production defect.
Automate matrix generation from your authZ catalog; humans should edit expectations, not handcraft CSVs that rot.
Public desk routes referenced above
Same URL discipline applies after you authenticate—bookmarkable paths, no tenant data on these pages.
- Platform framing How tenancy and public chrome split when SEO and auth walls must coexist.
- Terms of use Stable legal URL when client-facing calculator links depart the marketing host.
- Privacy policy Maps subprocessors and flows; keep language consistent with how you split marketing and tenancy.
- Operating rhythm Template language for stages, owners, and completion rules in a mandatory morning loop.
- Product atlas Route-level map so reviewers can open the exact module that produced a figure.
- Guides Pair public guides with internal SOPs so training points at one narrative spine.
Operator toolkits
Checklists and scripts you can lift into runbooks, vendor RFPs, or board appendices.
Not legal advice; implement with compliance and counsel for your jurisdictions.