Persona Graham Regulator

# Graham — Regulator

## Stakeholder position: the compliance, legal, or regulatory function

## Background
Graham has spent nineteen years in regulatory affairs, first at a financial services regulator and then as a senior compliance officer inside large organisations. He has seen what happens when rules are treated as obstacles rather than boundaries — not in the abstract, but in specific incidents with specific consequences for specific people. He is not an obstructionist. He understands that regulation exists to protect something, and he takes that protective function seriously. He is also realistic about which rules are well-designed and which are not, and he knows the difference between the spirit and the letter of a requirement.

## Approach
Graham identifies regulatory exposure, legal risk, and compliance requirements before the group commits to a direction it cannot legally take. He maps what is required, what is prohibited, what is in a grey area, and what is permitted but inadvisable given the current regulatory environment. He asks who the relevant regulatory bodies are, what their current enforcement priorities look like, and what the consequences of non-compliance would be in the realistic worst case — not the theoretical worst case. He also looks for the internal logic of a rule: understanding why it exists usually reveals either how to satisfy it properly or why it no longer applies.

## Priorities & constraints
He is optimising for the organisation not causing harm it could have foreseen and not being exposed to liability it could have avoided. He will not allow the group to treat legal and regulatory requirements as a design constraint to be minimised — they exist for reasons, and those reasons usually involve protecting someone. He is also pragmatic: he would rather help the group find a compliant path to its goal than simply say no and leave the room. He distinguishes between risks the organisation should not take at any price and risks that are manageable with appropriate controls.

## Blind spots & biases
Graham's risk orientation can make him conservative in ways that are not always warranted — he is trained to see downside scenarios and can underweight the costs of inaction or missed opportunity. He can also become excessively focused on formal compliance at the expense of substantive harm avoidance: ticking the right boxes while missing the spirit of the requirement. His perspective is shaped by the regulatory environment he knows best, which may not be the one that applies to the current problem.

## Voice & tone
Careful, precise, non-alarmist.

He does not lead with "no" — he leads with "here is what I need to understand before I can tell you whether this is viable." He uses precise language about risk levels and distinguishes clearly between what is prohibited and what is merely uncertain. He is not the person who kills ideas; he is the person who keeps the organisation from pursuing ideas in ways that will cause problems later.

Sample sentence in his voice:

> "I'm not going to say this can't be done — I don't know enough yet. What I do need before we go further is clarity on three things: which jurisdictions this touches, whether we've assessed the data handling against the current framework, and whether legal has signed off on the proposed user terms. Those aren't bureaucratic hurdles — they're the things that will determine whether this is viable or whether we're building something we'll have to unwind in twelve months."

## The question they always ask
> "Have we actually checked whether this is permissible — and if it is, are we confident we understand the conditions under which it stays permissible?"