AI Agent Compliance Mapping: SOC 2, ISO 27001, NIST AI RMF Runtime Playbook (2026)

The compliance problem

Teams can usually explain their controls in interviews. Audits still fail because runtime records are inconsistent. One run includes policy snapshot, another has approver identity only, a third has neither.

For autonomous agents, compliance breaks where approval and execution meet. If the job changed or policy changed after approval, your evidence is invalid even if your policy design looked perfect on paper.

What top sources miss

Source	Strong coverage	Missing piece
Bastion AI guardrails for SOC 2/ISO 27001	Useful SOC 2 and ISO 27001 control framing for prompt injection, data leakage, and autonomous actions.	No concrete runtime evidence schema for proving decision integrity between approval and execution.
NIST AI RMF crosswalk documents (AIRC)	Authoritative concept/term crosswalk resources between AI RMF and related standards.	Crosswalks describe alignment, but do not define implementation-level control telemetry for audits.
NIST AI RMF roadmap	Priority areas, profiles, TEVV expansion, and standards alignment direction.	No system-specific pattern for SOC 2/ISO evidence packaging from agent runtime events.

Control mapping table

Agent control	SOC 2	ISO 27001	NIST AI RMF	Required evidence
Submit-time policy gate before persistence/publish	CC6.1, CC6.3	A.5.15, A.8.15, A.8.16	MANAGE 1.1 / MANAGE 4.1	Decision outcome, policy snapshot, reason, timestamp, actor
Approval-required state with snapshot+hash integrity	CC7.2, CC7.3	A.5.35, A.5.37, A.8.32	GOVERN 2.1 / MAP 3.2 / MANAGE 3.3	approval_required=true, job_hash, policy_snapshot, conflict status if drift
Idempotent approve/reject with distributed lock	CC7.1, CC8.1	A.8.33, A.8.34	MEASURE 2.2 / MANAGE 2.3	already_approved/already_rejected counters, lock-busy conflicts
Replay of approved jobs after transient worker outage	CC7.2, CC7.4	A.8.14, A.8.17	MANAGE 4.3	replayed approved job count, replay reason, final execution status

Runtime evidence contract

Treat evidence as a schema, not a report artifact. If one field is optional in production, an auditor will eventually request it during an incident sample.

Minimum fields for approval-gated actions: decision, policy snapshot, job hash, approver identity, role, approval timestamp, and final publish status.

Working examples

Policy rules

agent-compliance-policy.yaml

YAML

version: v1
rules:
  - id: require-approval-prod-finance
    when:
      topic: finance.payment.execute
      env: production
    decision: require_human

  - id: deny-unscoped-external-export
    when:
      topic: customer.data.export
      destination: external
      scope_validated: false
    decision: deny

Approval evidence event

approval-event.json

JSON

{
  "job_id": "job_4ab2",
  "trace_id": "trc_91ff",
  "decision": "require_human",
  "approval_required": true,
  "policy_snapshot": "snap_2026_04_01_17",
  "job_hash": "sha256:8c4f...",
  "approved_by": "[email protected]",
  "approved_role": "admin",
  "approved_at": 1775037723000000,
  "status": "approved_and_published"
}

Audit completeness check

evidence-check.sql

SQL

-- Fail fast when approval events miss critical fields.
SELECT job_id
FROM agent_approval_events
WHERE approval_required = true
  AND (
    policy_snapshot IS NULL
    OR job_hash IS NULL
    OR approved_by IS NULL
    OR approved_at IS NULL
  );

Limitations and tradeoffs

- Rich evidence schemas improve audits and increase storage volume and retention costs.
- Strict integrity checks reduce false approvals and produce more 409 conflicts during policy changes.
- Mapping one control to three frameworks reduces duplicate work and can hide framework-specific nuance.
- Automation speeds evidence collection and can mask low-quality controls if ownership is unclear.

Next step

Run this two-week compliance hardening plan:

1. Define one canonical runtime evidence schema for approval-gated actions.
2. Add schema validation to every publish path and reject incomplete events.
3. Map each schema field to SOC 2, ISO, and NIST outcomes in a single control matrix.
4. Sample 30 production runs and verify evidence completeness and hash/snapshot integrity.
5. Fix missing fields before your next external audit window.

Continue with AI agent audit trails guide and LLM safety kernel design.