What SOC 2 asks of an agent system
SOC 2 evaluates controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy. For traditional software, the evidence is familiar: access logs, change tickets, monitoring alerts. For agents, the auditor faces a new question: what is the unit of action?
The answer is the tool call. Everything an agent does to the world happens through tool calls: reading data, writing records, sending messages, spending money. If the auditor cannot see and check each tool call, the processing integrity criterion has no evidence behind it.
The evidence list
- Per-call execution records. Every tool call with caller, timestamp, inputs, and outputs. The agent's activity at the granularity the auditor can test.
- Tamper evidence. Records minted by the execution layer with cryptographic commitments, so the auditor knows the evidence survived contact with the system it describes.
- Independent verifiability. The auditor recomputes commitments themselves, with no reliance on the vendor's console or the operator's word.
- Access traceability. Which data each call touched, so confidentiality and privacy criteria can be tested against actual data flows.
- Completeness. Sequence numbering so the auditor can confirm no calls are missing from the record set under test.
Where agent SOC 2 efforts stall
The stall point is almost always the evidence, not the controls. Teams write good policies, restrict access properly, and monitor diligently, then hand the auditor a dashboard export and a log file the agent wrote itself. The auditor's job is professional skepticism, and self-written logs are where skepticism lands.
The fix is to make the evidence checkable by construction. AER-1 verifiable execution receipts, published as the IETF Internet-Draft draft-zambo-aer1, mint a receipt per tool call at execution time: tool, caller, timestamp, canonical inputs and outputs, SHA-256 commitment, sequence position. The auditor's test becomes mechanical: recompute, compare, confirm completeness.
Hand this to your auditor
The Auditor Packet is the printable companion: what a verifiable receipt is, a real sample to check, and the checklist in auditor language. Get the Auditor Packet.
Mapping receipts to criteria
- Security and confidentiality: access traceability per call shows exactly what data each action touched.
- Processing integrity: per-call receipts with commitments prove processing happened as recorded, completely and accurately.
- Availability: sequence gaps and timestamps evidence when the agent ran and whether runs completed.
Receipts do not replace controls; they evidence them. The control says the agent only reads approved data. The receipts prove which data it actually read.
Generate audit-grade evidence today
Mint a real AER-1 receipt for a real tool call, free, no signup. Hand it to your auditor and ask them to verify it. That is the entire evidence story in one minute.