Grafting regulations into business protocols: Supporting the analysis of risks of violation

The interaction of autonomous and heterogeneous business partners is often specified by business protocols. Particularly challenging is the case when such protocols must embed regulations, that change along time. In this work we focus on commitment-based protocols extended with temporal constraints among commitments and facts. We formalize a notion of “grafting” of new regulations inside protocols, where the new activities, foreseen by the regulation, are properly interleaved with the original ones thanks to the temporal contraints. We present a tool that exploits these principles to support the analysis of risks of violation, an apply it to two real-world case studies. This is a starting point for defining a notion of protocol compositionality that meets the requirements of flexible enactment, typical of cross-business settings, as well as that of modularity typical of Software Engineering.

1 Introduction

Business processes involve autonomous partners with heterogeneous software designs and implementations. In many practical settings, the reality in which business processes operate is characterized by a high degree of regulation. This is, for instance, the case of banking and of trading services, and of personal data flow management. The single organization needs to actively determine its processes on a permanent basis, to understand how regulations impact on the internal organization, to reason about possible risks of violation, and to ensure compliance to directives and laws. In such cases, the specification of the business interaction acquires a normative value and is commonly referred to as business protocol.