Securing Compliance: A Principled Approach