Abstract: The innovation disclosed and claimed herein, in one aspect thereof, comprises systems and methods of compliance management and determining non-compliance. The systems and methods can process a data request from a user and generate a permission token for a service operator and a service request for the data request. The systems and methods can determine a service operator that has permissions to solve the data request. The systems and methods can receive the permission token and the service request when the service operator has solved the data request and process the permission token and the service request upon completion of the data request by the service operator. The systems and methods can determine non-compliance based on receiving an expired permission token, an invalidated service request, or only one or neither of the two. The systems and methods can generate and alert and/or recommend security actions according to an escalation matrix.