Explain why a compliance handler is not agent work

Your telecom backend must implement a data retention handler that a regulator requires. It decides which call records are kept and for how long, who may request them, and how each request is logged. The rules are in a 60-page compliance document, and the company is audited against it every year. A product manager asks why you will not let the agent "build it from the spec" as it did for the last CRUD feature.

What do you tell the PM, and where, if anywhere, does the agent help?