Scope
SOC 2 controls checklist for agentic SaaS
Enterprise buyers treat SOC 2 Type II as the default trust artifact for SaaS vendors, and for agent products the questions have sharpened: auditors anchor on CC6 (logical access) and CC7 (system operations and monitoring), but what they now probe is whether your agent's actions are attributable, logged, and reviewable — who can invoke or modify the agent, how agent identities are separated from human and service identities, and what the agent actually did across the audit period. The 'why' is no longer hypothetical. Asana's MCP server shipped May 1, 2025 with a tenant-isolation flaw that let users retrieve data from other customers' workspaces; Asana found it June 4, took the server offline June 5, restored it June 17, and notified roughly 1,000 customers (per UpGuard's incident report). Budget realistically: published startup estimates converge on a first-year SOC 2 total of roughly $25,000-$80,000 with a compliance automation platform (Rippling's SOC 2 for startups guide puts the all-in first year at $25,000-$60,000; EIM Services' 2026 cost breakdown at $25,000-$75,000), with a Type II observation window of 3-12 months — six months is the common startup choice (Sprinto's SOC 2 cost guide). This checklist covers the agent-specific controls a generic template misses.
Agent Identity and Access (CC6)
4 checksGive every agent its own identity, separate from human users and shared service accounts
Auditors reviewing agentic systems under CC6 look for separation between human users, service accounts, and AI-agent identities. If your agent acts through a shared service account, you cannot attribute actions or scope revocation — one compromised credential grants everything the agent can do.
Enforce per-tool permission policies with tenant binding on every call
The Asana MCP incident was an authorization failure, not a hack: results honored the requester's permission set but were not re-scoped to the requester's own tenant, exposing projects, tasks, and comments across ~1,000 customers (UpGuard). Every tool call your agent makes must re-verify tenant binding at the data layer, not just at session start.
Require human approval for irreversible or high-privilege agent actions
A documented approval gate (deletes, payments, external sends, permission changes) is the control auditors accept as compensating for agent autonomy under CC6. Without it, you are asserting the model never misfires — a claim no auditor will accept as a control.
Time-box and scope agent credentials; never issue long-lived static keys to agents
Agent credentials are attractive theft targets because they aggregate tool access. Short-lived, per-task tokens bound to a specific tool scope make credential theft a bounded incident instead of a full compromise, and give you clean revocation evidence for the audit period.
Agent Action Audit Trails (CC7)
4 checksLog every agent tool call with inputs, outputs, initiating principal, and tenant context
Type II evidence must show what the agent did over the full observation period — requests, tool calls, data flows, and outputs that remain attributable and reviewable. A transcript of the chat is not an audit trail; you need structured records of each side effect.
Monitor for anomalous agent behavior, not just infrastructure health
CC7 review for AI systems now expects continuous monitoring of anomalous inference patterns and unintended agent behavior — a spike in tool-call volume, calls to tools a workflow never used before, or cross-tenant access attempts. Standard uptime dashboards do not cover this.
Make prompt injection a named threat in your risk assessment and incident runbook
Injection via retrieved content is the canonical agent-specific attack path: a malicious document or ticket steers the agent into exfiltrating data through its legitimate tool access. Auditors increasingly ask how agent-caused events are detected, contained, and disclosed — 'we trust the model' is a finding, not an answer.
Retain agent logs for at least the audit observation window, with tamper-evident storage
A Type II observation period of 3-12 months (six months is the common startup choice) means logs rotated at 30 days cannot evidence your controls. Set retention to cover the full period and restrict who can modify or delete audit records.
LLM Sub-Processor and Data-Flow Disclosure
4 checksList your LLM providers as sub-processors and map exactly which customer data reaches them
Enterprise security reviews ask what leaves your boundary. You need a data-flow map showing which fields reach Anthropic or OpenAI, under which DPA. Both publish canonical terms: OpenAI's API retains content up to 30 days for abuse monitoring unless the customer qualifies for Zero Data Retention, and does not train on API customer content by default (openai.com DPA and API data-usage pages).
Verify retention terms per model, not per vendor — they differ
Anthropic's own docs (platform.claude.com, API and data retention) state that API conversation content is not retained by default but designated Covered Models carry a mandatory 30-day retention, ZDR is not available for those models, and trust-and-safety-flagged content can be retained up to 2 years. Quoting a blanket 'zero retention' claim your stack cannot deliver is the kind of misstatement that unwinds a deal late.
Answer the training question in writing before buyers ask
Both major providers state API customer content is not used for training by default without permission, but your security questionnaire answer must cite the specific terms you operate under — enterprise reviewers check your claims against the providers' published DPAs.
Document a provider-switch or degradation path for LLM outages and term changes
Availability commitments in SOC 2 extend to critical sub-processors. Provider retention terms and model deprecations changed repeatedly through 2025-2026; showing you can pin versions, switch providers, or degrade gracefully is availability evidence auditors accept.
Audit Logistics and Buyer Reality
3 checksBudget $25,000-$80,000 and the better part of a year for the first Type II cycle
The Type II audit alone runs $7,000-$50,000 for startups (Sprinto; Secureframe quotes $7,000-$100,000 across firm tiers), and first-year totals with an automation platform land at $25,000-$60,000 (Rippling) to $25,000-$75,000 (EIM Services, 2026). Add a 3-12 month observation window — commonly six months — plus readiness and report writing, and the first cycle consumes most of a year. Start before your first enterprise prospect asks, not after.
Use a compliance platform for baseline evidence, but write the AI-specific controls yourself
This is where the platforms honestly lose: Vanta- and Drata-style automation covers infrastructure monitoring and standard evidence collection well, but does not automatically cover AI-specific risks like agent action attribution, model access controls, or training-data provenance — those need manual controls and custom evidence mapping regardless of which platform you buy.
Do not wait for the report to start enterprise conversations
Buyers typically require the report before procurement closes, not before the first call. A signed audit engagement plus this control set in place is usually enough to keep a deal moving while the observation window runs.
Common Mistakes
- Running the agent through one shared service account, making every action unattributable and every credential leak a full compromise.
- Checking permissions at session start but not re-verifying tenant binding per tool call — the exact failure class behind the Asana MCP cross-tenant exposure.
- Claiming 'zero data retention' with an LLM provider whose terms actually mandate 30-day retention for the models you use.
- Treating conversation transcripts as an audit trail instead of logging structured tool-call records with inputs, outputs, and initiating principal.
- Buying a compliance automation platform and assuming it covers agent-specific controls — the platforms themselves position AI risks as requiring custom controls.
- Starting SOC 2 only after an enterprise buyer asks, then discovering the Type II observation window alone is commonly six months or more.