Compliance explainer
WSLCB compliance: coded gates vs operator-handed
WSLCB compliance is the term every cannabis-POS website uses. It means two different things depending on who's saying it. Either the platform refuses the action when the rule is broken — or the platform documents the rule and hands enforcement back to the operator. Both can technically be called 'compliant.' Only one keeps you from a $5,000 fine when a budtender forgets at 9:55pm on a Saturday.
The two definitions, side by side
| Approach | What it does | Risk model |
|---|---|---|
| Documentation-only | Lists the rule in a manual / training module / KB article | Operator carries 100% of enforcement risk |
| Coded gate | Refuses the action at the platform level | Platform carries the enforcement load; operator carries the audit trail |
Both call themselves 'WSLCB-compliant' on the website. Both are technically truthful. The difference shows up at 9:55pm on Saturday when a budtender about to ring up an under-21 sale either gets an audit-logged refusal-screen — or doesn't.
Five gates that should be coded, with WAC citations
Not every WSLCB rule needs a gate — some are operator-side judgment calls (advertising decisions, hiring criteria, security planning). But the five below are mechanical enforcement points where a coded gate is straightforward and documentation-only is a known failure mode.
- Sale-to-minor (WAC 314-55-079(1)). The retailer licence permits sale “to persons 21 years of age and older, EXCEPT as allowed for persons under 21 years of age consistent with RCW 69.50.357 and WAC 314-55-080” — so the check is ELIGIBILITY, not a bare 21. At a medically endorsed outlet an 18–20 qualifying patient with a recognition card may lawfully buy (RCW 69.50.357(2)); a gate hard-coded to 21 refuses them. Verification has to fire on every transaction with no soft-fail path. Manager override exists, requires PIN + reason + audit-log row. Coded gate refuses to add a flagged item to cart until ID is scanned + birth-date computed + eligibility confirmed.
- Transaction limits (WAC 314-55-095). One ounce of useable cannabis, sixteen ounces of solid edible and seven grams of concentrate per transaction for a 21+ or non-database customer; three ounces, forty-eight ounces and twenty-one grams for a patient or designated provider entered in the medical database. Documentation-only asks a budtender to hold two different limit sets in their head and know which one the person in front of them is on. Coded gate reads the lane and refuses the line.
- Recall response (WAC 314-55-225). Notification to the local enforcement officer is immediate, not next-day, and the affected product has to be secured and isolated with no grace window. Documentation-only means the clock depends on someone remembering the SOP during the worst hour of the year. Coded gate quarantines the lot and stamps the notification time.
- Surveillance retention (WAC 314-55-083). A minimum of 45 days of video retention is required. Documentation-only puts a manager's spreadsheet between you and an inspection. Coded gate runs a nightly probe of the DVR/NVR retention window, writes an incident the moment retention drops below threshold.
- Manager-override audit. Any manager-PIN override on a coded gate should write an audit-log row with actor + timestamp + reason. WAC 314-55-087(2)(a) is the hook: a POS is an acceptable place to keep the required records only if it “provides an audit trail so that details … underlying the summary accounting data may be identified and made available upon request”. The underlying rows are (1)(d) “records of all financial transactions” and (1)(r) “detailed sale records including … date of sale, sale price, item sold, and taxes assessed”, retained for the five years -087(1) requires. Documentation-only says 'managers should document overrides.' Coded gate refuses the override until the reason field is filled in — no shortcut path, no 'reason: see notes.'
What 'documentation-only' looks like — when it fails
Documentation-only compliance fails in predictable patterns. Across operator forums and years of WSLCB inspection experience, the patterns are remarkably consistent.
- The new-hire pattern. A budtender who started 3 weeks ago hasn't internalized rule X yet. The training module exists; the rule was covered in onboarding; the actual enforcement at the register is muscle memory the new hire hasn't built. A coded gate works on day 1; documentation only works on day 91.
- The end-of-shift pattern. Last sale of the night, manager already in the office counting cash. Budtender takes a shortcut they wouldn't take at 2pm. Documentation says 'no shortcuts.' Coded gate doesn't permit the shortcut.
- The relationship pattern. Customer is a regular. Budtender wants to do them a favor — skip the ID re-check, apply a discount that's 95 days old. Documentation says 'no exceptions.' Coded gate refuses the exception.
- The rule-change pattern. WSLCB updates a rule via Implementation Letter (IL). Documentation update has to land in the SOP binder + the training module + the operator chat group. Coded gate updates once, ships once, applies everywhere.
When documentation IS the right answer
Not everything should be a coded gate. Some rules are inherently operator-judgment. Trying to code those creates platform brittleness without a compliance gain.
- WAC 314-55-155 advertising rules. Advertising decisions involve content judgment. The platform can flag risky language (efficacy claims, medical-advice language) but can't make the final call.
- Premise-security planning. WAC 314-55-083 sets hardware and record duties — badges and the visitor log, alarms, surveillance, traceability — and imposes no written security plan. The written instrument Washington requires is the OPERATING PLAN under WAC 314-55-020, filed on a board template, with prior board approval before you change it or the floor plan. The platform can hold the plan and verify retention windows; the security framework itself is human-designed.
- Hiring + termination decisions. Manager-write-up assistant (per the v0.38 guide) helps document — but the decision to hire, write up, or terminate is a human responsibility.
- Customer service exception calls. When a customer has a legitimate edge case the rule doesn't anticipate, the operator handles it. The platform should make the exception easy to log; the platform should not pretend it can decide.
The audit-trail compromise
The cleanest line: code the gate where the rule is mechanical, document where it's judgment-based, and audit-log everything either way. WSLCB inspectors aren't asking 'did you have a manual.' They're asking 'show me the trail of every override' — and the window is FIVE YEARS. WAC 314-55-087(1) requires records to be kept on the licensed premises “for a five-year period” and made available for inspection on request by an LCB employee. If you can produce that in 30 seconds, you pass; if you can't, you don't.
Takeaways
- 'WSLCB-compliant' means two different things: documentation-only (operator carries enforcement risk) vs coded gate (platform refuses the action)
- Five gates that should be coded: trade-sample quarterly cap / surveillance retention at 45 days / records retention at five years / vendor-licence expiry / manager-override audit
- Documentation-only fails in 4 predictable patterns: new-hire muscle memory / end-of-shift shortcuts / relationship favors / rule-change propagation lag
- Documentation IS right for judgment-based rules: advertising content, security framework, hiring decisions, customer-service exceptions
- The audit trail is the unifying answer — code where mechanical, document where judgment, log everything either way
Frequently asked
- When a POS says it's 'WSLCB-compliant,' what am I actually getting?
- That phrase means one of two different things. Documentation-only compliance lists the rule in a manual, training module, or KB article and leaves the operator carrying all the enforcement risk. A coded gate refuses the action at the platform level when the rule is broken, so the platform carries the enforcement load while you carry the audit trail. Both can truthfully call themselves compliant, but only the coded gate stops a budtender from ringing up an under-21 sale at 9:55pm on a Saturday.
- Which compliance rules should actually be coded into the platform versus left to staff to enforce?
- Five mechanical enforcement points should be coded gates: the trade-sample cap of 30 units to any one employee per calendar quarter (WAC 314-55-096(1)(j)(vi) — name the subsection, because §096 sets FIVE quarterly caps and only this one is yours to enforce: (1)(f)(i) limits a producer to 96 flower units per processor, (1)(f)(ii) limits a processor to 120 units per retail business, and (3) caps a processor’s own internal-QC samples at 50 units and 25 concentrate units per employee. A gate that says it enforces “§096” and counts only the 30 is claiming four caps it does not touch), surveillance retention of at least 45 days (WAC 314-55-083, which requires recordings kept “for a minimum of 45 days on the licensee’s recording device”), records retention for the five-year period WAC 314-55-087 imposes, vendor-licence expiry on the vendor record, and manager-override audit logging so an override leaves a row rather than a memory. Rules that involve human judgment should stay documentation-based instead: advertising content decisions (WAC 314-55-155), the premise-security framework, hiring and termination calls, and customer-service exception cases. Trying to code judgment-based rules creates platform brittleness without a compliance gain.
- Why does documentation-only compliance keep failing in practice?
- It fails in four predictable patterns. A new hire hasn't built the register muscle memory yet, so a coded gate works on day 1 while documentation only works on day 91. At end of shift a budtender takes a shortcut they wouldn't take at 2pm, and with a regular customer they want to do a favor and skip a re-check or apply a stale discount. And when WSLCB updates a rule via Implementation Letter, a documentation change has to land in the SOP binder, the training module, and the operator chat, whereas a coded gate updates once and applies everywhere.
Related guides
Ready to talk through your migration?
30-minute demo. We end by quoting the cutover from your current setup — fixed scope, no hourly games.