Agentic compliance: Five controls to require before AI agents run your compliance program

A compliance team running SOC 2, ISO 27001, HIPAA, and PCI-DSS sends many of the same evidence requests every cycle. While teams in Engineering, IT, HR, and Legal get chased for access lists and screenshots they supplied last year, and each file lands wherever that owner sends it. So when the auditor's PBC list arrives, the team has to pull the same evidence back out of shared drives, email threads, and Slack before it can respond.

For teams running several frameworks at once, many of those requests repeat across all frameworks. That repetitive work suits AI agents, because most of it follows the same steps every cycle and calls for little judgment. An agent can propose the scope for a new framework, pull evidence through system integrations, and send requests to control owners without someone starting each step. The harder calls, such as whether a file actually proves a control works, stay with your team.

That is why compliance leaders need to set limits first. An agent doing compliance work changes records and contacts real people inside the same systems your auditors test.

Before AI agents take on compliance work, require five controls: authorization, scope limits, reversibility, logging, and human escalation.

Why agentic compliance needs controls that AI assistants do not

When a compliance team uses AI to draft, a model writes a control description or summarizes a policy, and a compliance manager reads it, edits it, and decides whether it goes into the control library. In this scenario, the person still takes the action.

An agent removes the pause between output and action. Picture an agent assigned to collect SOC 2 evidence. It queries the identity provider, pulls a user access list, messages the IT owner for a missing screenshot, and attaches the file to a control. Each step changes a record or reaches a real person, yet no one reviews the steps one at a time.

Model testing and output review cover none of those steps. Once an agent can act, your controls have to cover which systems it reaches, what it changes, and who approves the next step. The five controls below apply that to agents doing compliance work. For a broader framework that runs from defining an agent's scope through shutdown planning, see my guide to governing autonomous AI agents.

Agents your business deploys for other work, such as customer support or software development, need the same controls, managed through your AI governance program. For more on inventorying and assessing those agents, see Optro AI Governance.

Five controls to require from compliance agents

Each control below answers a question your auditor will eventually ask about work an agent did. Set them up once, and your team can let agents pull evidence and send requests without signing off on every step.

Authorization: Who the agent acts as

An agent that runs on a person's login credentials gets that person's access. If that person is an admin, the agent is too. An evidence-collection agent running under a compliance manager's login can read every HR record that manager can see, even when the task needs only termination dates.

The OWASP Top 10 for Agentic Applications (2026) lists identity and privilege abuse among the top risks for agent systems, including agents that run on borrowed or over-scoped credentials.

What to require:

• Each agent runs under its own identity, separate from any employee account
• Access is granted on a least-privilege basis, one system and permission set at a time
• Any expansion of an agent's permissions needs a new approval

Scope limits: Which frameworks and data the agent covers

Scope sets which tasks and data an agent can work on inside the systems it is authorized to reach. An agent scoped to the SOC 2 user access review should not start answering a vendor security questionnaire because it found files that looked relevant.

What to require: written scope for each agent before it runs. Name the frameworks, controls, data sources, and audit period it covers, and set an alert for any request that falls outside them.

Reversibility: Whether a mistake can be undone

OpenAI's Practices for Governing Agentic AI Systems recommends requiring human approval before an agent takes actions too consequential to delegate, such as an irreversible financial transaction. To apply that to compliance work, sort every action an agent can take into three tiers by what it would cost to reverse:

1. Read-only actions change nothing. Pulling an access list or searching an evidence library carries little risk.
2. Reversible actions can be corrected. A draft stakeholder request held in a queue, or evidence attached to a control pending review, can be edited or removed.
3. Irreversible actions cannot be recalled. An email sent to 40 control owners, access revoked in production, or a package submitted to an auditor stays done.

What to require: agents run the first two tiers on their own, and every action in the third tier goes to a person.

Logging: What happened and why

A model log can stop at a prompt and an output. An agent log has to capture the chain: the goal, each tool call, the data the agent accessed, the decision it made, the result, and any human approval along the way.

That record matters most in the audit. For example, when an auditor asks why a control was marked effective in March, the log should show which evidence the agent pulled, from which system, on what date, and who signed off. If the log cannot show that chain, your team has no record to hand the auditor.

What to require: a log that ties every agent step to a control, a source system, a date, and an approver, kept where your auditors already review evidence.

Human escalation: When the agent stops and asks

Escalation rules tell an agent when to hand a decision to a named person. Common triggers include:

• Conflicting or incomplete evidence for a control
• A request that falls outside the agent's scope
• Any irreversible action
• A finding that suggests a control failure or a needed risk exception

Say an agent finds that a terminated employee still has active system access. It should not revoke the access itself. It should route the finding to the control owner with the evidence attached, a deadline, and a place to record the decision. Judgment calls stay with the people accountable for them. An agent cannot accept a risk exception or answer an auditor's follow-up questions on your team's behalf.

For more on how human review should limit what agents do in GRC work, see why GRC judgment matters as agents take on more work.

How Agentic Compliance handles the coordination work

At CRX 2026, Optro introduced Agentic Compliance for teams whose compliance program resets every audit cycle. Compliance should not reset every year. Agentic Compliance turns that annual scramble into a continuous program, where AI does the coordination and your team keeps the judgment.

When a new framework comes into scope, agents read it, propose which requirements apply, and suggest control owners. Your compliance manager signs off on the scope and ownership. Throughout the year, agents collect evidence through system integrations and send automated requests to stakeholders. At audit time, agents map evidence to the auditor's PBC list and package it for submission.

That work compounds. Your evidence library and the decisions behind it carry forward, and cross-framework coverage analysis shows where work you did for earlier frameworks already covers the new one. The next audit then packages evidence that your program maintained all year.

Your compliance manager stays the accountable decision-maker on risk exceptions, control design, and auditor conversations. Agentic Compliance runs inside Optro's connected GRC platform, so agent work happens on the same platform as your controls, risks, and audits, rather than in a standalone compliance tool.

Set the controls before agents take on compliance work

Agents can take on the repeat coordination that fills a compliance team's year. Before they do, require five controls:

1. Authorization: Each agent gets its own identity and only the access it needs for its task.
2. Scope limits: Name the frameworks, controls, and data the agent covers before it runs.
3. Reversibility: Anything that cannot be undone goes to a person.
4. Logging: An auditor should be able to trace every step, from data pulled to sign-off.
5. Human escalation: Judgment calls stay with the people accountable for them.

Set the guardrails first. Then let agents chase evidence and coordinate frameworks while your team makes the calls on exceptions, control design, and auditor questions.

Agentic Compliance is now available

See it in action