Legal compliance is not one-size-fits-all. It is user config dependent. Every deployment, every organization, every jurisdiction has unique rules. A system that passes audit in one state or country might fail instantly in another. The only way to stay aligned is to bind compliance logic directly to user configuration.
User config dependent compliance means rules update as the config updates. Encryption strength, data retention, logging scope, profile permissions—these must connect to the active configuration, not a static code path. It requires engineering discipline: build compliance checks that read from config at runtime, validate values against current legal requirements, and trigger alerts or enforcement when mismatches occur.
Ignoring this leads to silent violations. A config change that enables a feature might also enable a regulatory obligation. If compliance is baked into the code without reading that config, you miss it. Worse, you break the law without noticing.