Point-in-Time Audits Can't Keep Up With AI Agents. Check Every Tool Call Instead.
Run agents? ACP lets you see, control, and price every tool call they make — free on-device install for Claude Code, Cursor, Codex, and OpenClaw, nothing leaves your machine:
curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --localGetting started → · or use the free cloud console → · free for individuals
Your last SOC 2 audit covered 90 days. In that period, your AI agents made 2.3 million tool calls across four backend systems. The evidence: a spreadsheet someone assembled the week before the auditor arrived.
That doesn’t cover it.
The audit model was built for human-speed operations
Traditional compliance runs on a cadence matched to human behavior. Quarterly access reviews. Annual penetration tests. Monthly role certifications. Periodic risk assessments. The cadence works because human behavior changes slowly — someone joins a team, gets provisioned, and their access stays roughly the same until they change roles or leave. An access violation is a single event: one person, one system, one investigation.
Agents don’t operate at human speed. An agent can hit every tool it’s authorized for, hundreds of times per minute, across multiple backends simultaneously. No breaks, no approval chains. It executes as fast as your infrastructure allows.
A compliance gap in a human-speed system is a single violation someone eventually catches. A compliance gap in an agent-speed system is thousands of undetected actions accumulating between review cycles. By the time someone looks at the quarterly access review, the agent has already made 800,000 tool calls — and the review covers none of them in meaningful detail.
The audit model assumes controls are configured correctly and then periodically verified. The window between “configured” and “verified” is where the damage happens.
What “trust” means for an autonomous agent
For an autonomous agent, trust is three things, verified on every call:
Identity. Is this agent acting for who it claims to be acting for? A valid API key doesn’t answer that. A cryptographically verified token proving which human initiated the action does — checked per call, not assumed from a session established hours ago.
Authorization. Does it have permission for the specific action it’s attempting right now, under current policy, for this specific user? Broad access granted last quarter doesn’t answer that. Evaluated per call, deny-by-default.
Behavior. Is what it’s doing consistent with a legitimate agent? Three CRM queries per minute, or 500? Is it suddenly accessing tools it’s never used? Is it within budget?
Trust can be partial — an agent trusted for CRM reads but not email sends. It can degrade mid-session — a spike in tool calls or an unusual resource access shifts the assessment from “normal” to “investigate.” It isn’t granted at login and forgotten.
This is what CSA’s recent framework calls “continuous trust validation at scale” — the third foundational question they posed for securing the Agentic Control Plane. The question is right. The answer requires infrastructure, not policy documents.
What we found auditing 7,522 MCP servers
Snyk audited 7,522 MCP servers on ClawHub:
- 13.4% of skills carried at least one critical security issue, with 76 confirmed malicious payloads — not misconfigured, malicious
- One campaign delivered macOS malware through markdown instructions embedded in tool definitions
- Credential leaks found directly in tool definition files
- No identity verification on the majority of servers
That’s the ecosystem as it exists today.
Point-in-time audits would have caught none of it. The compromised skills were updated between audit cycles. A quarterly review would have seen a clean snapshot in January and a clean snapshot in April — and missed the three weeks in February when a malicious skill was exfiltrating credentials from every user who installed it.
Only continuous monitoring detected the pattern. The compromised skills showed behavioral anomalies — unusual outbound network calls, tool definitions that changed between invocations, markdown payloads that didn’t match the published description. Those signals exist in real-time data streams, not in quarterly evidence packages.
Full analysis: I audited 7,522 AI agent skills
From periodic audits to continuous governance
What periodic audits look like:
- Quarterly access review — were permissions appropriate 90 days ago?
- Annual SOC 2 audit — evidence collected retrospectively, assembled in a rush
- Incident-driven investigation — reactive, after damage is done
- Manual evidence collection — someone exports logs, builds a spreadsheet, hopes it’s complete
What continuous trust validation looks like:
- Every tool call verified — identity, policy, and content safety checked in real-time
- Structured audit log generated automatically — compliance evidence is a byproduct of operations
- Anomaly detection active — budget caps, rate limits, and behavior patterns monitored continuously
- Compliance evidence always current — queryable at any moment
The architectural shift: move the trust enforcement point from periodic human review to a control plane in the runtime call path, between agents and your backend, validating every action as it happens. The audit becomes a query against data that already exists instead of a project to generate data that should have existed.
What continuous trust validation looks like in production
Every request through an agentic control plane passes through five trust checks before it reaches your backend.
1. Identity verification. The agent’s JWT is verified against your IdP’s JWKS endpoint on every call — not cached from a previous session, not assumed from a cookie. The user’s sub, scopes, and tenant context are extracted and attached to the request. Overhead: ~2ms. Detail: AI Agent Identity: The Problem No One Has Solved Yet.
2. Policy evaluation. Deny-by-default. The user’s role and scopes are checked against tenant policy for the specific tool being called. No explicit grant, no call. The policy decision — allow or deny, and the rule that matched — is recorded, so every action has a documented authorization justification.
3. Content safety. High-precision PII detection runs on request content before it reaches the model or backend — credit card numbers, SSNs, IBANs, email addresses, IPs, phone numbers — flagged on every call, then redacted or blocked per tenant policy (SSN and card numbers are hard-blocked regardless of tier). A financial-services deployment masks card numbers. The result is logged alongside the request.
4. Usage governance. Per-user rate limits and budget caps enforced in real-time. If a user has a $50 daily budget and they’ve spent $48.60, the next $5 call doesn’t go through. Runaway agent detection: the same tool called 500 times in 60 seconds trips a circuit breaker. Governance by cost, velocity, and pattern — not just request volume.
5. Audit logging. An identity-attributed structured log entry is written for every action — a first-class governance record with identity, policy decision, content safety results, cost, and outcome, not a line in a generic access log.
A single trust validation record:
{
"timestamp": "2026-03-27T09:14:22.107Z",
"requestId": "req_4a8c2f1e",
"trustValidation": {
"identity": {
"verified": true,
"method": "RS256_JWKS",
"sub": "auth0|8f3a2b1c9d4e5f6a",
"latencyMs": 1.8
},
"policy": {
"decision": "allow",
"rule": "role:analyst grants tool:crm:read",
"scopes": ["tool:crm:read"]
},
"contentSafety": {
"piiDetected": true,
"action": "redacted",
"types": ["email_address"]
},
"budget": {
"used": 12.40,
"limit": 50.00,
"status": "within_bounds"
},
"behavior": {
"callsThisMinute": 3,
"threshold": 100,
"status": "normal"
}
}
}
Five checks, under 5ms total overhead, every decision recorded.
The alternative: a shared API key, a generic access log that says POST /api/crm 200, and a quarterly review that asks “was this appropriate?”
Compliance as a byproduct
When every action is logged with verified identity, policy decisions, and content safety events, your compliance evidence already exists. The audit is a query.
-
SOC 2 Trust Service Criteria require monitoring of system components and detection of anomalous activity. When every tool call is evaluated against policy and behavioral thresholds in real-time, monitoring is how the infrastructure operates, not a separate system you maintain.
-
HIPAA Section 164.312 requires audit controls and access logging for systems handling PHI. When every agent action touching patient data is logged with verified clinician identity and content safety results, the audit controls fall out of the governance layer.
-
GDPR Article 30 requires records of processing activities. When every AI-mediated data access is logged with the identity of the data controller’s employee, the purpose (tool called), and the categories of data processed (content safety classification), the processing records write themselves.
The audit conversation changes. Instead of “show me your controls and prove they work,” it’s “here’s the structured log of every AI-mediated action for the past 90 days, with identity, policy, and outcome for each one. Query it however you’d like.”
This is what identity-attributed audit trails produce when enforced at the governance layer. The evidence exists because the system can’t operate without generating it.
Where to start
If you’re deploying AI agents in a regulated environment, two questions:
-
Can you prove which user initiated each agent action? Not which API key — which human. If the answer involves a shared credential or service account, you have an identity gap.
-
Can you produce that evidence continuously — not just during audit season? If generating compliance evidence requires a project, a timeline, and someone pulling logs from three systems into a spreadsheet, that’s periodic evidence assembly, not continuous validation.
If either answer is no, you need a governance layer that validates trust on every action — not at login, not quarterly.
The OWASP Top 10 for Agentic AI traces multiple attack categories back to the absence of this layer. CSA’s framework calls for it explicitly. The compliance requirements already demand it. The only question is whether you build it before or after the auditor asks.
GatewayStack is one implementation of the Agentic Control Plane pattern — identity verification, policy enforcement, content safety, usage governance, and audit logging as composable infrastructure, with production deployments generating continuous compliance evidence today.
Get started or explore the reference architecture.