Well, there’s the law (federal, state, etc), then the additional regulatory rulings (federal, state, etc), then the as-applied department policies. Not really a lack of “law” but a mess of constraints that need to be deciphered into functional requirements with footnotes, matrixed to testing and preserved/maintained for the next guy. Ugh.. I want to charge the gov. 2k hrs for just thinking about it today.