Regulatory governance across countries, ERPs, and effective dates
Centralized middleware for statutory parameters, immutable versions, approval workflows, sync governance, and compliance visibility.
Enterprise governance operating model
CQRS-ready command flow, event bus, scheduler, retry queue, tenant isolation, and websocket notification health.
Regulatory change pipeline
Monthly volume by domain and status
Compliance score
On trackCountry pack compliance heatmap
i18n + local rulesGovernance SLA widgets
2 watchCritical effective dates
Governance activity
Versioned statutory and payroll parameter registry
Every parameter change creates an immutable version with effective dating, approval routing, and ERP sync targeting.
Input perubahan tax bracket tahunan
Untuk contoh perubahan tax bracket tahun 2025: klik tombol di kanan, isi effective date 2025, update bracket rows, lalu simpan sebagai Draft Version.
| Rule | Country | Domain | Effective period | Version | Workflow | Sync | Action |
|---|
Indonesia PPh21 progressive tax brackets
Approved future version with dependency analysis against payroll engines, legal entities, and employee populations.
[
{"max": 60000000, "rate": 0.05},
{"max": 250000000, "rate": 0.15},
{"max": 500000000, "rate": 0.25},
{"max": 5000000000, "rate": 0.30},
{"max": null, "rate": 0.35}
]
[
{"max": 75000000, "rate": 0.05},
{"max": 260000000, "rate": 0.15},
{"max": 520000000, "rate": 0.25},
{"max": 5000000000, "rate": 0.30},
{"max": null, "rate": 0.35}
]
| Connector | ERP | Legal entities | Strategy | Status |
|---|---|---|---|---|
| HM3 Indonesia Payroll | HM3 | 18 | Webhook | Scheduled |
| Novea Lite Payroll | Novea | 7 | REST API | Mapped |
| HMX Core HR | HMX | 22 | Event stream ready | Ready |
Effective dating
Future scheduledv3.2 published
Current production tax bracket.
v4.0 approved
Government draft reflected and locked.
v4.0 goes live
ERP sync window opens 72 hours before effective date.
Immutable history, rollback planning, and visual comparison
Rules are never overwritten. Each approved change is stored as a distinct version with audit evidence and publication windows.
Version history
ID.PAYROLL.PPH21.BRACKET| Version | Effective from | Effective to | Status | Approved by | Change reason | Action |
|---|
Country, legal, finance, and integration sign-off center
Enterprise RBAC routes changes to the right approver based on country, domain, risk level, and sync blast radius.
Approval matrix
Country + domain + riskMonitor REST, webhook, scheduled sync, and retry execution
Track regulatory payload propagation to multiple ERP implementations and isolate mapping or authentication failures.
Sync log
5 failures| Timestamp | Connector | Rule | Strategy | Status | Response |
|---|
Distributed sync architecture
Event-driven readyPublish rule
Validated against optimistic version and row-level policy.
rule.published
Emitted to domain event bus with tenant scope.
Sync jobs
Connector-specific background jobs with retry policy.
Connector adapters
Novea, HM3, and HMX adapters with governed mapping.
Websocket
Live sync result pushed to approval owners.
API-first integration setup for downstream ERP systems
Define tenant-scoped connectors with authentication, payload mapping, sync strategy, and retry policy.
Connector setup flow
Create or edit a connector by defining the target server, endpoint, authentication method, sync strategy, retry policy, and mapping profile.
Connector SDK pattern
Pluggable adaptersinterface RegulatoryConnector {
validate(payload): Promise<ValidationResult>
map(rule): Promise<ConnectorPayload>
publish(payload): Promise<SyncResult>
rollback(version): Promise<SyncResult>
healthCheck(): Promise<ConnectorHealth>
}
BaseConnector NoveaConnector HM3Connector HMXConnector RetryPolicy maxAttempts: 5 backoff: exponential deadLetter: enabled
Multi-country statutory coverage and governance ownership
Manage currencies, regulatory domains, source references, country owners, and publish readiness by jurisdiction.
Tamper-evident activity viewer for governance evidence
Every create, update, approve, publish, sync, and rollback action is logged with old and new values.
| Time | Entity | Action | Performed by | Old value | New value |
|---|
Assess operational blast radius before publishing a rule version
Estimate affected ERP systems, countries, legal entities, employee populations, payroll runs, and statutory reports.
Dependency chain
Medium riskPPh21 brackets
Feeds payroll tax computation and employee payslip statutory summary.
Monthly payroll close
Open payroll periods need recalculation preview before publication.
Statutory filing
Withholding report parameters map to existing DGT report templates.
Recommended controls
AI-readyRequire country owner sign-off
Material employee tax impact above threshold.
Stage sync to non-live tenants
Validate Novea, HM3, and HMX payload compatibility.
Schedule rollback candidate
Keep v3.2 payload available for controlled rollback.
Exception monitoring for expiry, conflicts, and failed syncs
Alerts are generated from effective dates, connector responses, overlapping rules, and country compliance calendars.
Enterprise runtime architecture for regulatory governance
Operational controls for tenant isolation, API keys, rate limits, feature flags, scheduler jobs, retry queues, websocket notifications, and audit middleware.
Security and isolation controls
Zero-trust API boundaryTenant context resolver
Resolves tenant from API key, JWT claims, or connector token.
Row-level permission filter
Scopes rules by tenant, country, domain, and legal entity ownership.
API key management
Rotatable hashed keys with scopes, expiry, rate tier, and audit metadata.
Audit middleware
Captures old/new payload, actor, tenant, request id, and idempotency key.
Background job lanes
Eventual consistencyConfiguration governance
Environment + feature flags + i18nComposable statutory packs for multi-country governance
Each country pack owns rule templates, validation constraints, localized labels, statutory calendars, source references, and connector mapping hints.
Indonesia pack
ReadyPPh21, BPJS, VAT, THR, overtime rules, ID locale, IDR currency, DGT source references.
Philippines pack
ReviewSSS, PhilHealth, Pag-IBIG, TRAIN tax, PHP currency, statutory report mapping.
Malaysia pack
ReadyEPF, SOCSO, EIS, PCB tax, MYR currency, English and Malay label bundles.
Singapore pack
ReadyCPF, GST, foreign worker levy, SGD currency, IRAS and CPF source templates.
Country pack contract
SDKCountryPack {
metadata
domains
ruleTemplates
validators
calendars
localization
connectorMappings
}Localization strategy
i18nlocales/ id-ID.json en-PH.json ms-MY.json en-SG.json formatters: currency date percent statutory labels
DDD modular monolith with CQRS-ready services and distributed sync fabric
This blueprint shows domain boundaries, command/query split, event bus abstraction, scheduler, retry queue, connector SDK, tenant isolation, and country pack extension points.
Domain-driven bounded contexts
DDD-readyBackend folder structure
NestJSapps/api/src
app.module.ts
config/
env.schema.ts
feature-flags.service.ts
common/
auth/rbac.guard.ts
auth/api-key.guard.ts
auth/rate-limit.guard.ts
tenancy/tenant-context.ts
tenancy/tenant-isolation.interceptor.ts
audit/audit.interceptor.ts
events/domain-event.bus.ts
jobs/scheduler.service.ts
jobs/retry-queue.service.ts
realtime/notification.gateway.ts
modules/
countries/
country-packs/
regulation-domains/
rule-categories/
regulatory-rules/
application/commands/
application/queries/
domain/regulatory-rule.aggregate.ts
effective-dating/
versioning/
approvals/
erp-connectors/
sdk/base-connector.ts
adapters/hm3.connector.ts
sync-monitoring/
audit-trail/
impact-analysis/
notifications/
api-keys/
compliance-monitoring/
ai-readiness/
prisma/
schema.prisma
seed.ts
Prisma schema excerpt
Normalizedmodel Country {
id String @id @default(uuid())
code String @unique
name String
currency String
rules RegulatoryRule[]
}
model RegulationDomain {
id String @id @default(uuid())
code String @unique
name String
categories RuleCategory[]
}
model RuleCategory {
id String @id @default(uuid())
domainId String
code String
name String
domain RegulationDomain @relation(fields: [domainId], references: [id])
rules RegulatoryRule[]
@@unique([domainId, code])
}
model RegulatoryRule {
id String @id @default(uuid())
tenantId String
countryId String
categoryId String
ruleCode String
ruleName String
description String?
valueType String
valueJson Json
effectiveFrom DateTime
effectiveTo DateTime?
version String
status RuleStatus
approvalStatus ApprovalStatus
sourceReference String?
createdBy String
approvedBy String?
createdAt DateTime @default(now())
updatedAt DateTime @updatedAt
country Country @relation(fields: [countryId], references: [id])
category RuleCategory @relation(fields: [categoryId], references: [id])
syncLogs SyncLog[]
@@unique([tenantId, ruleCode, version])
@@index([countryId, categoryId, effectiveFrom])
}
API contracts
API-firstGET /v1/countries POST /v1/countries GET /v1/regulation-domains GET /v1/rule-categories?domainId= GET /v1/regulatory-rules POST /v1/regulatory-rules GET /v1/regulatory-rules/:id POST /v1/regulatory-rules/:id/versions GET /v1/regulatory-rules/:id/versions POST /v1/regulatory-rules/:id/compare POST /v1/regulatory-rules/:id/submit POST /v1/approvals/:id/approve POST /v1/approvals/:id/reject GET /v1/erp-connectors POST /v1/sync-jobs POST /v1/sync-jobs/:id/retry GET /v1/audit-trails POST /v1/impact-analysis/simulate GET /v1/compliance-alerts
Seed data excerpt
Sample countriescountries = [
{ code: "ID", name: "Indonesia", currency: "IDR" },
{ code: "PH", name: "Philippines", currency: "PHP" },
{ code: "MY", name: "Malaysia", currency: "MYR" },
{ code: "SG", name: "Singapore", currency: "SGD" }
]
domains = [
{ code: "PAYROLL_TAX", name: "Payroll Tax" },
{ code: "SOCIAL_SECURITY", name: "Social Security" },
{ code: "INDIRECT_TAX", name: "VAT/GST" },
{ code: "LABOR_LAW", name: "Labor Law" }
]
connectors = [
{ connectorType: "HM3", syncStrategy: "WEBHOOK" },
{ connectorType: "Novea", syncStrategy: "REST_API" },
{ connectorType: "HMX", syncStrategy: "SCHEDULED" }
]
Future regulatory intelligence layer
Prepared for document parsing, AI impact analysis, anomaly detection, recommendation, and regulatory change monitoring.
Document parsing
Ingest gazettes, tax circulars, and ministry notices into structured candidate rule changes.
AI impact analysis
Rank affected countries, legal entities, employees, reports, and ERP mappings before approval.
Anomaly detection
Detect unusual parameter deltas, overlapping effective dates, or rates outside statutory patterns.