SOC 2 controls approve actions that AI agents perform under human access credentials, without distinguishing them from human activity. Example: an access audit line shows a senior engineer executing 50 database queries in production at 10:03 AM. The control passes, but the engineer was drinking coffee at that time and their agent performed the updates.
The gap between standard and risk
SOC 2’s technology-neutral criteria can cover AI agents, but they do not explicitly require treating agents as a separate identity class. This discretion allows AI agents to add risk without failing any control.
When an agent operates under a human identity, all of that person’s access permissions are available to it. If the engineer is authorised to read customer data, the agent can do so too. If they have write permissions, the agent can modify records. The audit system sees the human username, and there is no way to know whether the action was intentional or automated.
Why this matters for organisations building AI systems
An Israeli company building AI systems for organisations and passing SOC 2 audits needs to understand that the standard does not protect it from this risk. An organisation can pass a SOC 2 audit and still be exposed: an agent that makes a mistake can delete data, a compromised agent can extract information, and the audit trail will only show that a legitimate user performed actions.
The problem is more acute in banking and financial systems, where regulation requires SOC 2 but does not yet address agents directly. A development team that assumes compliance with the standard is sufficient may discover that it met every requirement but created a security gap.
What to do this week
If you are building a system that uses AI agents, create a clear separation between human identities and agent identities now. Every agent needs a separate service account with minimal permissions, and every action it takes needs to be recorded in a dedicated audit trail that explicitly states this is an automated action.
Document the logic that led to each action: not just “user X executed a query”, but “agent Y executed a query following a request from user X at time Z”. This is not just a technical improvement – it is what allows you to answer the question “who did this and why” when something goes wrong. If you need help designing such a system, read about AI agents for business and how to build them securely from the start.
Sources
- With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance · BleepingComputer
Frequently asked questions
Is SOC 2 enough to secure a system with AI agents?
No. SOC 2 checks access controls, but does not require separating human identities from agents. You can pass an audit and still be exposed if agents operate under human accounts.
How do you know if an AI agent performed an action or a human?
Only if you designed for it from the start. You need a separate service account for each agent and an audit trail that explicitly records the source of the action. If the agent uses human access credentials, there is no way to know.