SOC 2 for Enterprise AI Agent Companies: Five Sections Beyond the Standard Checklist

The market is voting for enterprise AI agents

In September, the coding-agent company Factory raised $200 million at a $5 billion valuation. Reuters framed it as part of a broader pattern: funding is concentrating around AI companies selling agents into large organizations.

That pattern has a compliance consequence. The same quarter an agent company signs its first seven-figure enterprise contract is usually the quarter it faces its most demanding security review yet — not just standard SOC 2 controls, but questions about model access, tool permissions, human oversight, data handling, and agent-action logging.

Enterprise buyers don't ask "are you SOC 2 compliant?" anymore. They ask "what does your agent do, what can it touch, and who watches it?"

Why "early-stage SaaS" is the wrong starting point

Most SOC 2 readiness advice is written for conventional SaaS: a web app, a database, an identity provider, a ticketing system. The controls map cleanly — access reviews, change management, backups, monitoring.

An enterprise AI agent company fails that mapping in three ways:

Your risk surface includes third-party models that process customer data — each one a vendor, each one a question.
Your product takes actions on the customer's behalf — in their repositories, their cloud accounts, their tickets. A standard access-control narrative doesn't cover that.
Your behavior changes when the model changes, which means change management needs an AI dimension no generic checklist mentions.

This is also where generic readiness platforms stop helping. They were built to get a conventional SaaS through a conventional audit. If your differentiation is agentic AI, your assurance program needs to show it.

What the enterprise security review actually asks

Sit in one of these reviews and the questions cluster into five groups. None of them appear in a stock SOC 2 questionnaire:

Which models do you use, hosted where, under what terms?
What happens to our data when it enters a prompt?
What can your agent do in our environment — and what can't it?
Where does a human approve or review what the agent did?
What happens when you swap a model version — and when it misbehaves?

A SOC 2 report that answers these five questions preemptively turns the review from a months-long negotiation into a formality.

The five sections that go beyond the standard checklist

Conventional SOC 2 controls — access reviews, change management, monitoring, vendor management — still apply. These five additions are what make an AI vendor's report credible to an enterprise buyer.

AI and model-provider inventory

Treat every model your product calls like a critical vendor. Keep a dated inventory: provider, model name and version, hosting region, what data it touches, which features depend on it, and the provider's security documentation on file.

A versioned model inventory table with owners and review dates
Model-provider SOC 2 reports or security pages, reviewed and dated
A documented fallback when a provider changes or deprecates a model

Customer-data and prompt flow

Enterprise buyers want to know exactly where their data goes when it enters a prompt. Map the flow end to end: what leaves your tenant, which providers process it, retention terms, and what is excluded — training, provider retention, human review.

A data-flow diagram covering prompts, completions, and logs
Provider terms showing zero-retention or no-training commitments
Redaction or filtering controls for sensitive fields in prompts

Agent tools and permission boundaries

Agents act — they call APIs, write code, touch repositories and cloud accounts. Document every tool an agent can invoke, the credentials it uses, the scope of those credentials, and what is explicitly out of bounds. Least privilege applies to agents more than to humans.

A tool-and-permission matrix per agent role, with scope limits
Screenshots of scoped credentials — no standing admin, no shared keys
Logs showing agent actions are recorded with actor, action, and time

Human review and escalation points

Autonomy is the product; oversight is the control. Show where a human must approve an action, how a reviewer is notified, and how the customer escalates a concern. An agent that acts without a review path is the first thing an enterprise security team flags.

A documented approval matrix: which actions need human sign-off
Samples of real review records — approvals with reviewer and timestamp
An escalation path with response-time commitments, tested at least once

Model-change, evaluation, and incident evidence

When you upgrade a model, your behavior changes — and so does your risk. Show that model changes go through evaluation before rollout, that results are retained, and that AI-specific incidents (bad outputs, prompt misuse, agent errors) are logged and resolved like any other incident.

Evaluation records before and after each model change, with dates
Change tickets linking model versions to rollout decisions
One or two real AI-related incident tickets with resolution notes

Every item answers the same three questions: what the control requires, proof it operated, and a date an independent auditor can place inside your observation window.

Make the evidence exist before the audit starts

The pattern from every first audit applies double here: evidence you create during the audit is weak; evidence that accumulated because your controls actually ran is strong.

The good news for AI companies: much of this evidence is already being generated. Agent-action logs, evaluation runs, model version records, approval flows — these exist in your product. The work is pointing audit evidence at them deliberately instead of reconstructing them from screenshots after the fact.

Start your model inventory this week. Write down your permission boundaries before your next enterprise deal asks. Test your escalation path once so it's real. By the time your Type II observation window opens, the AI-specific half of your report will already be collecting itself.

Audit intelligence that understands agentic AI

Skadi is audit intelligence for a network of Independent CPA audit firms. Specialized audit models cross-check every control against your evidence — including the AI-specific sections above — so nothing is missed and nothing is invented. Models run on AWS Bedrock, with no training on your data and no retention by model providers.

If you're an enterprise AI vendor heading into your first SOC 2, you don't need a generic readiness pipeline. You need a report your buyers' security teams will actually accept.