<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta>
      <journal-title-group>
        <journal-title>J. Caballero-Villalobos);</journal-title>
      </journal-title-group>
      <issn pub-type="ppub">1613-0073</issn>
    </journal-meta>
    <article-meta>
      <title-group>
        <article-title>Compliance⋆</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <string-name>Juanita Caballero-Villalobos</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Hugo A. López</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="editor">
          <string-name>Business Process Compliance, Business Process Monitoring, Goal-driven Compliance, I-star models, WF-nets</string-name>
        </contrib>
        <aff id="aff0">
          <label>0</label>
          <institution>Technical University of Denmark</institution>
          ,
          <addr-line>DTU Compute</addr-line>
          ,
          <country country="DK">Denmark</country>
        </aff>
      </contrib-group>
      <volume>000</volume>
      <fpage>0</fpage>
      <lpage>0001</lpage>
      <abstract>
        <p>The goal of a business process is to orchestrate activities that achieve a specific business objective. However, most process simulation tools do not assess how activities influence the satisfaction of business goals. addresses this limitation by aligning imperative and declarative process models with goal models to evaluate compliance with high-level and non-functional requirements. Unlike existing tools, Kogi traces how process executions afect goal satisfaction in both runtime and design-time scenarios. The tool focuses on monitoring the fulfillment of organizational objectives rather than procedural correctness alone. This support shows potential to improve traceability and interpretability of compliance outcomes and enhance communication across stakeholders involved in the business process lifecycle.</p>
      </abstract>
    </article-meta>
  </front>
  <body>
    <sec id="sec-1">
      <title>1. Introduction</title>
      <p>The workflow specified in business process models defines how organizational goals are operationalized.
These goals can be classified into high-level business requirements or non-functional requirements, such
as strategic objectives, compliance expectations, or performance constraints. Goal-oriented analysis is
crucial for strategic decision-making at the executive level, where the focus is not on specific actions
but on achieving broad business objectives. Current commercial platforms for process execution and
simulation (i.e., SAP Signavio1, Camunda2, DCR Solutions3) primarily emphasize activity execution and
process automation, without unveiling how those process activities contribute toward goal satisfaction.</p>
      <p>
        To the best of our knowledge, the approaches that have been developed to align process activities and
organizational goals focus on the correctness of the design of the process and goal model by capturing
the behaviours of each other [
        <xref ref-type="bibr" rid="ref1 ref2 ref3">1, 2, 3</xref>
        ] (i.e., goal decomposition, sequence order, constraints). Still, no
work has been carried out so far specifically monitoring the composed evolution of the satisfaction of
goals based on process execution as based on business process meta-models insights [
        <xref ref-type="bibr" rid="ref4">4</xref>
        ]. Moreover,
all conformant traces identified for most compliance checking approaches [
        <xref ref-type="bibr" rid="ref5 ref6 ref7">5, 6, 7</xref>
        ] are treated as
equally satisfactory, without distinguishing which compliant executions are more desirable or better
aligned with organizational priorities [
        <xref ref-type="bibr" rid="ref8">8</xref>
        ]. For instance, consider a municipal caseworker handling
construction permits. They follow a set procedure with activities A, B, and C. This process leads to
either acceptance, rejection, or further investigation of the case. They complete activities A, B, and C as
required. Regardless of the outcome, they are compliant with the procedure. However, if we look at the
case from the perspective of the caseworker’s interests, like wanting to save time on decisions, or the
municipality’s goal to promote urban development, we see a diferent picture. They prefer a steady
increase in acceptance rates. This shows that not all compliant outcomes are equally favorable based
1Pronounced KOH-gee, or Cogui, in honour of the Indigenous group that resides in the Sierra Nevada de Santa Marta mountains
in northern Colombia.
CEUR
      </p>
      <p>ceur-ws.org
on the agent’s goals, and a simple scenario of the hidden things in process execution that potentially
compromise transparency and interpretability of compliance outcomes.</p>
      <p>
        We introduce Kogi, a tool that addresses this gap by enabling compliance monitoring between process
execution and high-level and non-functional requirements. The tool provides a graphical interface that
allows users to upload their process models, goal models, and mappings between process activities and
goal elements to conduct compliance analysis. Kogi is primarily designed to support legal compliance
assessments, targeting process analysts and compliance oficers. It aims to establish a shared vocabulary
that facilitates co-creation and interdisciplinary collaboration in legal compliance contexts. However,
the tool’s applicability extends beyond the legal domain, depending on its configurable features. The
compliance evaluation focuses on the satisfaction of the goals and follows the execution semantics
described in [
        <xref ref-type="bibr" rid="ref9">9</xref>
        ]. The tool supports three main usage scenarios: (1) run-time monitoring, (2) design-time
compliance evaluation, and (3) interactive what-if simulation, each enabling diferent modes of reasoning
about compliance across the business process lifecycle. To sum up, the tool advocates for enhancing
traceability between process execution and organizational goals and improving communication across
the business process compliance lifecycle.
      </p>
    </sec>
    <sec id="sec-2">
      <title>2. Architecture</title>
      <p>Kogi follows a four-layer architecture designed for flexible scalability. The system processes
wellformed process models, goal models, and mapping files to provide comprehensive compliance verification
across three operational modes: runtime monitoring, design-time evaluation, and what-if simulation.
Layer 1 (UI/Frontend) ofers four main components: a file upload interface for ingesting models,
visualizers for process and goal models, an LTS (Labeled Transition System) viewer for exploring
state spaces, and a compliance dashboard for monitoring results. Once models are uploaded, Layer 2
(Backend/APIs) manages input validation and rendering through RESTful services. It processes and
visualizes the models, allowing users to inspect their structure. Layer 3 (Business Logic/Services)
contains the system’s core transformation logic. An input parser feeds the model generator and LTS
service, which construct LTSs for both process and goal models. These are synchronized by the
compliance service to generate a composed LTS representing the integrated system. Users can then
initiate runtime or simulation analysis. Layer 4 (Data/Storage) manages persistence. The model
repository stores uploaded models; state storage holds generated LTSs and traces; the compliance
database logs violations; the event log store captures runtime activity; and a caching layer improves
performance.</p>
    </sec>
    <sec id="sec-3">
      <title>3. Functionality</title>
      <p>To demonstrate Kogi’s capabilities, consider the statement below. Figure 2 models the process using the
identifier of the activities (i.e., a ) as transition, and Figure 3, shows how some activities contribute to
achieve the goal and quality of marketing’s team.</p>
      <p>a The process begins with the registration of a customer request, which is followed by an examination phase.
This examination includes b a review of the applicant’s credit history and/or c validation of income and
employment status to assess creditworthiness. After the registration, the ticket undergoes d a verification
process that confirms the authenticity of the submitted documents and verifies the applicant’s identity through
Know Your Customer (KYC) procedures. e A decision can only be made once both examination and verification
are completed. At this point, the process proceeds to either g approve the request and issue a credit card or
g reject the request. If the available information is insuficient, the process restarts to
data.
f collect additional
Typically, if the examination reveals that the applicant has no credit history, the credit card request is rejected.
However, to attract younger credit card holders, the marketing department has launched a campaign targeting
specific customer profiles. Under this initiative, selected applicants are only required to undergo c —the
validation of income and employment status— to be considered for a credit card ofer, regardless of their credit
history. The overall objective of the marketing team is to increase credit card adoption among young adults
( G goal), to increase flexibility in onboarding young adult applicants ( Q quality).

a</p>
      <p>1
 2

Run-time Monitoring The first use case illustrates run-time monitoring of how event traces afect
the satisfaction of the goal model elements. Figure 4 shows the evolution of the status of process model
(Figures 2) and goal model (Figures 3) elements given a trace vs Kogi’s result.</p>
      <p>Each event triggers a re-evaluation of goal satisfaction. Green nodes indicate satisfied elements, red
indicate unsatisfied ones, and blue highlight elements marked for re-execution due to prior quality
constraints4. The satisfaction of non-functional requirements or quality constraints ( ) may evolve,
then executions initially classified as non-compliant may become compliant in subsequent traces.
Moreover, Kogi supports what-if scenario reasoning, where users can manually trigger process events
and observe the resulting changes in token flow and goal satisfaction. As shown in Figure 4, if the task
g is executed, the goal G will be achieved. This enables analysts, policy designers, and compliance
engineers to assess decision alternatives and failure scenarios. The goal model structure reflects how
non-functional requirements (i.e., quality constraints) afect compliance: deviations in execution (i.e.,
time) or unmet quality goals can result in a non-compliant state, even when all functional steps are
completed.</p>
      <p>Design-time Compliance The second use case addresses the design-time evaluation of process
models against business goals. In this scenario, the composed labeled transition system (LTS) is computed
from the Petri net and synchronized with the goal model via a synchronous product construction. This
enables the enumeration and assessment of all reachable execution paths. The system generates a
set of compliance reports that indicate which paths satisfy, violate, or remain neutral for specific
business requirements. This use case supports early-stage validation and process redesign to ensure
alignment with normative goals. Figure 5 shows the interactive interface (Kogi’s React version) to
perform design-time compliance analysis.</p>
      <p>Availability Kogi is available5 in both React and Python versions. Figure 6 shows an embedded
interactive notebook’s output within the Python application, showcasing its functionality.</p>
    </sec>
    <sec id="sec-4">
      <title>4. Maturity</title>
      <p>
        Kogi’s maturity is limited and was assessed using qualitative criteria relevant to software evaluation.
The tool is built using a React-based interface and modular backend services that support model parsing,
labeled transition system construction, and compliance reasoning. Input data, including process models
in PNML, goal models in JSON, and mappings in CSV, are handled through isolated components to
support maintainability and independent testing. The implementation enables three usage scenarios:
runtime monitoring, design-time evaluation, and interactive simulation. Each mode presents a distinct
view on compliance by linking execution traces to satisfaction states of intentional elements across
the process lifecycle. Trace-level feedback is updated incrementally, allowing users to observe the
propagation of efects on goal elements. A core maturity feature lies in the ability to determine whether
all high-level goals are satisfied by each execution path. Additional maturity aspects relate to portability,
interpretability, stability, and testability. The system is deployable through platform-independent
technologies and requires no installation beyond a browser. Compliance outcomes are labeled at the
4see the semantic details in [
        <xref ref-type="bibr" rid="ref9">9</xref>
        ] and Kogi app details in the repository https://github.com/jc4v1/Kogi-App
5https://github.com/jc4v1/Kogi-App
trace level and linked to goal elements, supporting interpretation of violations and satisfactions without
inspecting internal state transitions. Stability has been assessed through deterministic test cases with
reproducible outcomes across execution modes. Testability is supported by the separation of model
transformation, goal evaluation, and compliance checking logic, which can be verified independently.
      </p>
    </sec>
    <sec id="sec-5">
      <title>5. Conclusions and Future Work</title>
      <p>The tool operationalizes goal-driven compliance checking by synchronizing Petri net execution with
goal model propagation. It supports runtime monitoring, design-time evaluation, and interactive
what-if simulation. Through these functionalities, the tool allows analysts to trace the impact of
process behavior on business goal satisfaction. Compliance states are computed and visualized at the
level of execution traces, enabling targeted feedback. The implementation demonstrates feasibility for
moderately complex models and supports use cases in audit preparation, regulatory alignment, and
decision analysis. Future extensions include probabilistic analysis and a mature version of the React
application, which will enhance user interface interaction.</p>
    </sec>
    <sec id="sec-6">
      <title>Acknowledgments</title>
      <p>This work is supported by the research grant “Center for Digital CompliancE (DICE)” (VIL57420) from
VILLUM FONDEN, and by the Innovation Foundation project “Explainable Hybrid-AI for Computational
Law and Accurate Legal Chatbots” 4355-00018B XHAILe.</p>
    </sec>
    <sec id="sec-7">
      <title>Declaration on Generative AI</title>
      <p>The author(s) have not employed any Generative AI tools.</p>
    </sec>
  </body>
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          [1]
          <string-name>
            <given-names>D.</given-names>
            <surname>Amyot</surname>
          </string-name>
          ,
          <string-name>
            <given-names>O.</given-names>
            <surname>Akhigbe</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.</given-names>
            <surname>Baslyman</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            <surname>Ghanavati</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.</given-names>
            <surname>Ghasemi</surname>
          </string-name>
          ,
          <string-name>
            <given-names>J.</given-names>
            <surname>Hassine</surname>
          </string-name>
          ,
          <string-name>
            <given-names>L.</given-names>
            <surname>Lessard</surname>
          </string-name>
          , G. Mussbacher,
          <string-name>
            <given-names>K.</given-names>
            <surname>Shen</surname>
          </string-name>
          ,
          <string-name>
            <surname>E. Yu,</surname>
          </string-name>
          <article-title>Combining goal modelling with business process modelling</article-title>
          ,
          <source>Enterprise Modelling and Information Systems Architectures (EMISAJ) 17</source>
          (
          <year>2022</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>
          [2]
          <string-name>
            <given-names>M.</given-names>
            <surname>Ruiz</surname>
          </string-name>
          ,
          <string-name>
            <given-names>D.</given-names>
            <surname>Costal</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            <surname>España</surname>
          </string-name>
          ,
          <string-name>
            <given-names>X.</given-names>
            <surname>Franch</surname>
          </string-name>
          ,
          <article-title>Óscar Pastor, Integrating the goal and business process perspectives in information system analysis</article-title>
          ,
          <source>in: Lecture Notes in Computer Science</source>
          , volume
          <volume>8484</volume>
          LNCS,
          <year>2014</year>
          , pp.
          <fpage>332</fpage>
          -
          <lpage>346</lpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>
          [3]
          <string-name>
            <given-names>H.</given-names>
            <surname>Horita</surname>
          </string-name>
          ,
          <string-name>
            <given-names>H.</given-names>
            <surname>Hirayama</surname>
          </string-name>
          ,
          <string-name>
            <given-names>Y.</given-names>
            <surname>Tahara</surname>
          </string-name>
          ,
          <string-name>
            <given-names>A.</given-names>
            <surname>Ohsuga</surname>
          </string-name>
          ,
          <article-title>Towards goal-oriented conformance checking</article-title>
          ,
          <source>in: Proceedings of the International Conference on Software Engineering and Knowledge Engineering</source>
          , SEKE, volume
          <volume>2015</volume>
          <source>-January</source>
          ,
          <year>2015</year>
          , pp.
          <fpage>484</fpage>
          -
          <lpage>489</lpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref4">
        <mixed-citation>
          [4]
          <string-name>
            <given-names>G.</given-names>
            <surname>Adamo</surname>
          </string-name>
          ,
          <string-name>
            <given-names>C. D.</given-names>
            <surname>Francescomarino</surname>
          </string-name>
          ,
          <string-name>
            <given-names>C.</given-names>
            <surname>Ghidini</surname>
          </string-name>
          ,
          <article-title>Digging into business process meta-models: A first ontological analysis</article-title>
          ,
          <source>in: Lecture Notes in Computer Science</source>
          , volume
          <volume>12127</volume>
          LNCS,
          <year>2020</year>
          , pp.
          <fpage>384</fpage>
          -
          <lpage>400</lpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref5">
        <mixed-citation>
          [5]
          <string-name>
            <given-names>M.</given-names>
            <surname>Hashmi</surname>
          </string-name>
          , G. Governatori,
          <string-name>
            <given-names>H. P.</given-names>
            <surname>Lam</surname>
          </string-name>
          , M. T. Wynn,
          <article-title>Are we done with business process compliance: state of the art and challenges ahead</article-title>
          ,
          <source>Knowledge and Information Systems</source>
          <volume>57</volume>
          (
          <year>2018</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref6">
        <mixed-citation>
          [6]
          <string-name>
            <given-names>H. A.</given-names>
            <surname>López</surname>
          </string-name>
          , T. T. Hildebrandt,
          <article-title>Three decades of formal methods in business process compliance: A systematic literature review</article-title>
          ,
          <year>2024</year>
          . URL: https://arxiv.org/abs/2410.10906. arXiv:
          <volume>2410</volume>
          .
          <fpage>10906</fpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref7">
        <mixed-citation>
          [7]
          <string-name>
            <given-names>H. A.</given-names>
            <surname>López</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            <surname>Debois</surname>
          </string-name>
          ,
          <string-name>
            <given-names>T.</given-names>
            <surname>Slaats</surname>
          </string-name>
          , T. T. Hildebrandt,
          <article-title>Business process compliance using reference models of law</article-title>
          ,
          <source>in: Lecture Notes in Computer Science</source>
          , volume
          <volume>12076</volume>
          LNCS,
          <year>2020</year>
          , pp.
          <fpage>378</fpage>
          -
          <lpage>399</lpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref8">
        <mixed-citation>
          [8]
          <string-name>
            <given-names>A.</given-names>
            <surname>Burattin</surname>
          </string-name>
          ,
          <string-name>
            <given-names>A.</given-names>
            <surname>Gianola</surname>
          </string-name>
          ,
          <string-name>
            <given-names>H. A.</given-names>
            <surname>López</surname>
          </string-name>
          ,
          <string-name>
            <surname>M.</surname>
          </string-name>
          <article-title>Montali, Exploring the conformance space (extended abstract)</article-title>
          ,
          <source>in: CEUR Workshop Proceedings</source>
          , volume
          <volume>2952</volume>
          ,
          <year>2021</year>
          , pp.
          <fpage>62</fpage>
          -
          <lpage>67</lpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref9">
        <mixed-citation>
          [9]
          <string-name>
            <given-names>J.</given-names>
            <surname>Caballero-Villalobos</surname>
          </string-name>
          ,
          <string-name>
            <given-names>A.</given-names>
            <surname>Burattin</surname>
          </string-name>
          ,
          <string-name>
            <given-names>H. A.</given-names>
            <surname>López</surname>
          </string-name>
          ,
          <article-title>High-level requirements-driven business process compliance</article-title>
          ,
          <source>in: Proceedings of the 23rd International Conference on Business Process Management (BPM</source>
          <year>2025</year>
          ), Springer,
          <year>2025</year>
          .
        </mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>