SOC 2 and AI agents: an audit built for humans does not see autonomous actors

SOC 2 assumes a human is behind every action in a system. An autonomous AI agent breaks that assumption: it can pass every SOC 2 control while being, at the same time, unowned, unregistered and running on borrowed credentials. The framework is not wrong; it was built for a world where the actors were human. And if the audit does not see the agents, it certifies a reality that is no longer whole.

What SOC 2 assumes, and why the assumptions fall

SOC 2 is an AICPA audit framework built on the Trust Services Criteria (2017, revised 2022), through which a service organization proves it has working controls for security, availability and confidentiality. The logical access controls (CC6.1, CC6.2, CC6.3), change management (CC8.1) and risk (CC9.2) rest, implicitly, on four assumptions:

• someone approves an account before it exists;
• every account has a known owner;
• the name in the log identifies the actor;
• what an account can do tells you what it is meant to do.

For a human, all four are reasonable. For an AI agent, all four fall.

Where it breaks, concretely

Identities with no owner. Agents do not appear through an approval workflow, but as a side effect of another action. Someone connects an assistant, an integration or an MCP server, and what is left behind is an identity that figures in no register as a bearer of access.

Authorization upstream of the audit evidence. What the agent decides is set in the prompt, before the change-management controls. The evidence the audit asks for is produced further down, where the decision has already been made.

Attribution made impossible. According to a Cloud Security Alliance study, 68% of organizations cannot clearly distinguish AI agent actions from human ones, and only 28% can tie an agent’s actions to a responsible human across all environments. An agent using an OAuth grant or a service account appears in the log as the human who set it up.

Point-in-time versus continuous. Access reviews happen periodically. An agent running non-stop on borrowed credentials does not surface between two reviews, because on review day everything looks fine.

Why it is a compliance problem, not just a security one

A SOC 2 report, like an ISO 27001 certificate, attests that you have controls that work. If those controls do not see the agents, the report stays true to the letter and false in substance: it certifies control over who does what, while a whole class of actors slips past it. The audit passes, but the promised effect, real control, does not happen. It is the same class of defect as a control that passes the configuration test and does nothing.

The scale is not small. Also according to CSA, 85% of organizations already have agents in production, 52% give them workload identities, 43% shared service accounts, and 31% let them run directly under a human user’s identity. Each of the last two means an agent that inherits rights beyond what it would need and that, in the log, carries a name that is not its own.

What you can do now, without waiting for the framework

• Treat machine accounts as users: named owner, registration, purpose stated in writing.
• List agents in the system description and test them explicitly, not just the human accounts.
• Tie every action to a responsible principal, an identifiable human or service, not to borrowed credentials.
• Give each agent only the privilege its purpose requires, not the role inherited from whoever set it up.
• Instrument attribution: so you can say, in the log, where the human ends and the agent begins.

What to take away

The lesson goes beyond SOC 2. Any human-centric framework, including ISO 27001 with its access controls in Annex A, covers only what it measures. If it does not measure non-human identities, it does not govern them, however many controls are ticked. The rule is the same as at any trust boundary: do not assume who the actor is, verify it, attribute every action to it and give it only the access it needs. Verify the effect, not the assumption.

Want to know what non-human identities actually run in your systems, and who answers for each one? Get in touch and we start from a review.

Sources

• Cloud Security Alliance: more than two-thirds of organizations cannot clearly distinguish AI agent from human actions
• Security Boulevard: CSA and Aembit survey, 68% cannot distinguish agent from human
• BleepingComputer: With the rise of AI agents, SOC 2 should adapt or risk irrelevance (sponsored by Token Security)