Compliance-Aware Control Governance