Enterprises must respect a number of regulations, with multilevel nature and which change along time. They must not only adapt their business interactions to the regulations and their changes but also evaluate the risks of violation of the new rules and to account for responsibilities. This work proposes a methodological framework for modeling and engineering business protocols, which gives primary position to the notions of commitment and responsibility, and supports the analysis of risks of violation when a new regulation is issued. We build on 2CL commitment-based protocols and introduce 2CL Methodology, a software engineering methodology for such protocols, which includes guidelines for specifying 2CL business protocols, for specialising them, and for composing a new 2CL protocol based on a set of given 2CL protocols. We developed a set of integrated software tools for the design and the analysis of 2CL protocols, with the aim of concretely supporting, on the one hand, designers in the task of identifying exposure to risks of violation, and, on the other hand, the management in the task of reasoning about accountability and of decision making. The proposal is evaluated by using a real-world case study from the banking sector.Keywords Commitment-based business protocols, regulations, methodologies, risks of violations, accountability
IntroductionBusiness protocols are a means for specifying the interaction of a set of autonomous parties with heterogeneous software designs and implementations. They have a normative value in that parties are expected to behave according to the protocol. In many practical settings, the reality in which such parties operate is characterized by a high degree of regulation, and the business relationships are increasingly constrained by the regulative and legislative framework. This is, for instance, the case of banking and of trading services.As new regulations are issued, there is the need of adapting business protocols to the new dictates, which usually restrict -e.g. by adding new commitments and new constraints -the possible interactions or require the combination of different protocols. Think, for instance,