By Josh Woodruff, Co-chair, CSA Zero Trust Working Group. Reviewed by Josh Woodruff. Published October 2026.
An auditor wants four records for each AI agent. The first shows who the agent is and who owns it. The second shows what it was allowed to do and who approved that. The third shows what it did. The fourth shows every time a human or a gate stopped it. Keep them for your whole audit window in storage where tampering shows. Tie each one to a control you already test.
Your auditor already knows how to test access controls and change management. Agents shake that up because software can act with nobody at the keyboard. So the real test is whether you can hand over a pack that proves all four records for each agent.
This page is that pack. Our post on what auditors ask about AI agents covers the questions. This one covers what to hand them. Your auditor decides scope, and this isn't legal or audit advice.
What evidence does an auditor actually want for AI agents?
Four records per agent, kept together as one pack. If you can't produce all four, the agent isn't auditable yet.
Record | What's in it | Who owns it | Where it lives |
|---|---|---|---|
Identity | Agent ID, version, named human owner, credential type | Security / identity | Inventory + IdP |
Permission | Approved scope, approver, approval date, policy version, held credential scope | Owner + GRC | Approval file + policy store |
Action | Timestamped tool calls, inputs, policy decision, result | Platform / security ops | Append-only log or SIEM export |
Intervention | Gate pauses, human approve/deny, kill-switch pulls, rollbacks, drill dates | Security ops + owner | Gate logs + incident store |
Do this: If one cell is empty, fill it before the audit window opens. Extra log volume won't stand in for a missing permission record. Start with production agents that can write, send, pay, or change permissions. Those are the rows an auditor will ask for first.
How do I prove what an AI agent was allowed to do?
Keep the approval record next to what the agent actually held. Logs show what happened. Permissions show what was supposed to happen. Auditors compare the two.
Do this: Keep the signed approval, with the scope and the date on it. Keep the token scope the agent really held, plus the policy version in force. If the token can do more than the approval allows, that's a finding, even when nothing went wrong and no alert fired.
Shared service accounts break this proof. If five agents share one key, you can't say which agent acted. Give each agent its own identity you can revoke, and keep the owner's name on the inventory row. The ownership rule is in Every AI Agent Needs One Accountable Human.
When scope grows, update the permission record that week. An old approval for a narrow Intern agent won't cover a later Principal that can send money or change permissions. Re-check after every tool or connector change too.
If you can't name the approver and the date, the permission record is incomplete. Rebuild it before anyone argues about log format.
What should an AI agent action log record?
One line per action, written by something the agent can't edit. A log that an agent's admin can change after the fact won't hold up.
Do this: Build each line from this checklist.
Agent ID and named owner
Timestamp (with timezone)
Tool, API, or system called
Triggering input (redacted as needed)
Policy decision: allowed, denied, or escalated
Policy version in force
Result of the call
Store the stream where the agent can't rewrite history. Append-only storage and hash chaining are plain ways to make tampering visible. Redact secrets and personal data field by field, and keep the line itself. Auditors need the decision trail. They rarely need the full prompt every time.
Fact: On October 16, 2026, NIST's CAISSI, the NSA's Super Intelligence Security Center, and CISA published ten voluntary key practices for incident readiness and response in super intelligence training and evaluation. Practice 5.3 says to "retain tamper-resistant logs with reliable timestamps sufficient to reconstruct agent trajectories, tool calls, reasoning traces, user interactions, environmental states, and security-control decisions." Practice 5.1 lists "rejected actions and tool calls" among the evidence to preserve. Our read: The practices are written for labs that train and evaluate frontier agents, so treat them as a reference point for your own agents. They back the same log line and the same record of every stop.
Fact: An individual IETF Internet-Draft, Signed, Hash-Chained Action Receipts for AI Agents (draft-sahu-agent-action-receipts-00), proposes signed receipts for agent actions. It's an Internet-Draft, work in progress. Our read: Use the idea now. A complete line today beats a perfect format next year.
What counts as evidence of human intervention?
Every stop is evidence. Record when a gate paused an action, who approved or denied it, how long it waited, and what happened next. Record every kill-switch pull and every rollback.
Then test it. Auditors will ask when you last proved the kill switch works. Until you've tested it, all you have is a promise.
Gates have to sit outside the model. If the agent can talk its way past the stop, the intervention record proves nothing. Our post on how to stop an AI agent before it acts covers that boundary. The undo side lives in Can You Undo What Your AI Agents Did Last Night?.
Do this: Run kill-switch drills on a set schedule, and pick the cadence with your auditor. Keep a dated record of each drill. Include the agent ID, the gate that fired, the person who pulled it, and what stopped and restarted. In ATF terms, this is Incident Response turned into evidence you can hand over. File the record with the intervention log, never in a private chat thread.
How long should we keep AI agent logs for SOC 2?
Long enough to cover your whole audit window. A SOC 2 Type II report looks at how controls worked over a period of time, and your auditor sets that period with you.
Our read: The AICPA doesn't set one fixed retention period for agent logs. Any number you hear, like twelve months, is a practitioner convention. Match retention to your Type II period and to any longer promises in your customer contracts.
Do this: Check your agent platform's default trace retention today. If it's shorter than your audit period, export to a store you control from day one. Keep the permission and intervention records for the same period. Put a named owner on the export job, so the stream keeps running when a platform admin leaves.
Test a restore once. An export you can't open won't count as evidence. Write the retention period on the inventory row next to the review date, so ops and GRC see the same clock. If legal holds apply, freeze those agent IDs the same way you freeze human mailbox holds.
How do AI agent controls map to SOC 2 criteria?
Map the four records to criteria you already test. Identity and permission records support access controls (CC6). Action and intervention logs support system operations (CC7). Approvals and policy changes support change management (CC8).
SOC 2 family (2017 TSC) | Agent evidence | ATF element |
|---|---|---|
CC6 Logical and physical access controls | Identity record, permission record, unique agent credentials | Identity Management, Segmentation |
CC7 System operations | Action log, denied or escalated decisions, intervention log | Behavioral Monitoring, Incident Response |
CC8 Change management | Approval record, policy version changes, scope changes | Data Governance, Identity Management |
Our read: The ATF column is our mapping. Fact: The CC6, CC7, and CC8 family names come from the AICPA's 2017 Trust Services Criteria (With Revised Points of Focus – 2022). Walk your auditor through the mapping before you build a control matrix on it.
Fact: In ATF's mapping on the ATF comparison page, ISO 27001 A.8.15 to A.8.16 (Logging and Monitoring) maps to Behavioral Monitoring, and A.5.24 to A.5.28 (Incident Management) maps to Incident Response.
Where does the Agentic Trust Framework fit in audit prep?
ATF gives you the five questions an auditor is really asking. Each one points to a record in the evidence pack.
Fact: The Cloud Security Alliance published ATF on February 2, 2026, under CC BY 4.0 (CSA). I created it and donated it. It turns five questions into 25 requirements across Identity Management, Behavioral Monitoring, Data Governance, Segmentation, and Incident Response.
Our read: The four-record pack is your day-to-day evidence. ATF is the control language that makes the pack something you can score. Use the public compare crosswalk to show how it sits next to ISO 27001, ISO 42001, and NIST.
Related questions
Is a SIEM full of agent logs enough for an auditor?
A SIEM can hold the action stream. You still need the other three records, plus a clear owner for each agent.
What if our agents run on a vendor platform we don't control?
Ask the vendor for exportable action logs and retention that covers your audit window. Ask how you'll keep intervention evidence. If their retention is shorter than your audit period, export into a store you control.
Book a Consult
If you want help building the pack, book a 90-minute agent trust assessment. We'll check which of the four records you can produce for each agent and leave you with a fix list in priority order. Book a Consult. You can also start with the free assessment.