Questions
90 questions, answered directly. The compliance half describes somebody else’s standards and cites them. The other half covers evidence for systems whose behaviour is not fixed by their source, where the honest answer is more often about what you cannot show than what you can.
Written by one person. About Intransic.
Choosing an auditor
Who may issue a report, how firms differ, and what to ask before signing.
Compliance tooling
What software can and cannot do for you here.
Controls around agents
Approval, rate limits, incident response and stopping a run in progress.
- What does human-in-the-loop have to look like before it counts as a control?
- Can I reuse the access-control evidence I already have for agent actions?
- What belongs in an incident response plan when the actor is an agent?
- How do I evidence a rate limit on an agent?
- How do I keep a human able to intervene in a long-running agent task?
- Can I evaluate an agent against production data?
Evidence auditors accept
What counts as evidence, and what only looks like it.
Evidence that holds
Telling a control that works from one that has merely never been reached.
- What does it mean for a capability to be implemented but never exercised?
- What's the difference between an agent that can't do something and one that just hasn't?
- How do I test that a guardrail holds, rather than that it exists?
- How do I know an agent's own evidence wasn't produced by the agent?
- How do I test an agent without a flaky test suite?
- What access should an agent have to its own logs?
Getting through procurement
Questionnaires, trust pages, subprocessors and what a reviewer is looking for.
- What is a trust page for?
- A customer sent a security questionnaire. What now?
- Am I responsible for my subprocessors' controls?
- Who is allowed to see my SOC 2 report?
- What is a complementary user entity control?
- A customer rejected my SOC 2 report. What now?
- Can I put a SOC 2 logo on my website?
- How do I read someone else's SOC 2 report?
- An enterprise customer asked for evidence our AI feature is safe. What do we actually send?
- My agent made a mistake that affected a customer. What do I tell them?
- Do I have to tell users an AI is involved?
- Is my agent a subprocessor?
Going through an audit
Scope, timing, cost and what happens each year after the first one.
Identity and attribution
Tying an action an agent took to the person who authorised it.
- How do I attribute an action an agent took to the person who authorised it?
- Does my agent need its own identity, or can it use the user's credentials?
- What is the right way to give an agent a secret?
- My agent calls other agents. What does that do to my evidence?
- Is a scheduled agent different from one a user invokes?
ISO/IEC 27001
Certification, management systems, and how it differs from a SOC report.
- What is the difference between SOC 2 and ISO 27001?
- Does ISO 27001 certification satisfy a customer asking for SOC 2?
- What is an ISMS?
- Do I have to get certified to benefit from ISO 27001?
- How do I check whether someone else's ISO certificate is real?
- What is an accreditation body and why does it matter?
Logging and observability
Recording what happened so the record is usable later.
Reading the report
The opinion, the assertion, the system description and what a finding means.
SOC reports, plainly
What SOC 1, 2 and 3 actually are, and what the words around them mean.
Systems that are not reproducible
Evidencing constraint when you cannot evidence behaviour.
Tenancy and data boundaries
Keeping one customer out of another customer, including in the parts built for relevance.
- How do I evidence that one tenant's data never reached another tenant's agent?
- How do I evidence that an agent's memory or context store isn't leaking between users?
- How do I evidence deletion when an agent may have copied the data?
- My support agent legitimately needs to see other tenants' data. How do I scope that?
Tools, providers and the supply chain
Where your evidence stops when the agent calls something you do not run.
- My agent calls third-party tools and MCP servers. Where does my evidence stop?
- How do I stop my agent being tricked into acting by content it reads?
- My model provider changed their terms. What do I actually need to check?
- How should I evaluate an agent framework for security?
- How do I know my tool definitions match what the tools actually do?
Trust services criteria
What a SOC 2 examination tests you against, and which parts you choose.
What an agent may do
Proving an agent cannot exceed the authority it was given.
- How do I prove an AI agent can't exceed the permissions it was given?
- What can a code review actually tell you about an agent's runtime authorisation?
- How do I scope an agent so it can only reach the caller's own resources?
- My agent needs to write, not just read. What changes?
- Should an agent be able to change its own permissions?
- What does least privilege mean for an agent?
When the model changes
What survives a model swap, a prompt edit or a provider migration.
- My agent behaves differently after a model change. Do my controls still hold?
- How do I show that a prompt change didn't weaken a control?
- How often does a control on an AI system need re-verifying?
- How do I version a prompt so a change is evidenced?
- What happens to my evidence when I switch model providers?