SOC 2 for AI agents: five controls to prove

Before an enterprise grants an AI agent autonomy, it will ask for proof that every action stayed inside approved limits. The proof is the control surface around the model. Buyers will request evidence that the agent could not act outside its scope, that its actions were logged, and that a human could replay them.

The threat clock is shorter than the review cycle

Attackers are moving faster than manual review. The average eCrime breakout time fell to 29 minutes, a 65% speed increase from 2024. CrowdStrike President Michael Sentonas told the CrowdStrike Fal.Con audience that breakout time is now zero.

The review question changes. When an agent moves through systems without a human in the loop, the company must show bounded reach, traceable inputs, and reviewable outputs. Speed does not prove safety. The enterprise needs the boundary, the log, and the validation.

Five controls make an AI agent defensible

Use this checklist before the agent acts alone. Each item should be testable in a minute, not a policy essay. The evidence should be operational: a config file, a permission list, a data map, an identity record, or a log entry. A control that exists only in a slide deck is not a control.

• Prompt scope: the agent has a written task boundary, and the boundary is visible in the prompt, config, or system instructions. A tester can confirm the agent refuses an out-of-scope request without a human override.
• Tool permissions: every tool the agent can call is listed, least-privilege, and disabled by default. A tester can confirm the agent cannot reach production data, payment systems, or admin APIs unless the permission is explicitly granted.
• Data lineage: the company can show where agent inputs came from, how they were stored, and which model or tool processed them. A tester can trace one sample request from source to output without guessing.
• Access controls: humans and agents use separate identities, with scoped roles and revocable credentials. A tester can confirm an agent identity cannot be used to log in, approve, or escalate outside its assigned scope.
• Audit logs: every autonomous action is logged with actor, timestamp, input, tool call, output, and approval state. A tester can replay one action and see why it was allowed.

The order follows the failure path. Controls that cannot be tested in a minute will not survive an audit.

Validation is the release gate

Autonomy should be earned in stages. Blackpoint Cyber's new autonomous identity threat detection and response agent can stop credential-based attacks on Microsoft 365 and Google Workspace accounts in 21 seconds at its fastest. The same agent was built on endpoint signals from over a million protected endpoints across its MSP customer base.

Before allowing autonomous action, Blackpoint Cyber spent months checking every AI SOC agent recommendation against human analysts. Joe Ussia, CEO of Toronto-based Blackpoint Cyber partner Infinite IT Solutions, said Blackpoint is not satisfied with a 21-second containment time. The pattern is bounded action, measured performance, human validation, then expanded autonomy.

Apply the same sequence to every release. Start with a narrow task. Run the agent under human review. Compare its recommendations to the decisions a human would make. Only after the mismatch rate is acceptable should the agent act alone. The mismatch rate is the evidence that the agent’s scope, tools, data, access, and logs are holding. Keep the release record separate from the model card. It should name the owner, the date, and the rollback path.

Exceptions are where the review breaks. A control is not real when the agent can bypass it. Human overrides must be logged and time-bound. Temporary tool enablements should expire. Auditors will look for the path from exception to incident.

If the agent cannot pass the five tests, keep it supervised and fix the controls before the next release.