Audit and compliance evidence for AI coding agents
When agents write code, auditors still ask who made a change, who approved it, and whether access was least privilege. This page is for security, GRC, and audit teams. It lists the records Permit.io produces in a software factory and how they relate to common control frameworks.
Permit provides controls and records. It does not make your organization compliant with any framework. Your auditor decides how these records apply to your scope. Permit.io's own SOC 2 Type II attestation is on the trust center.
What the decision log records
| Source | Fields | Where to read it |
|---|---|---|
| Permit MCP Gateway | Timestamp, agent user key (agent|{client_id}), action (the tool), resource (the MCP server), decision, denial reason | Gateway Agents page and the Permit audit log. See audit logs. |
| Human-in-the-loop approvals | Request, approver, outcome (approved, rejected, timed out), time | Approvals > History. See Approval history. |
| HTTP Egress Proxy | Agent, target host and path, matched rule, allow or deny | Proxy audit trail. See Audit trail. |
| Your services | Every permit.check() your code makes, with the agent as the subject | Permit audit log, or forwarded from your PDPs. See Forward decision logs. |
| Humans and agents | Grants, trust levels, and revocations | Gateway Humans and Agents pages. See Managing humans and agents. |
The egress proxy writes its audit trail on a best-effort path. If you need a guaranteed record for a control, also enforce and log that action with a permit.check() in the service that performs it.
Answer common audit questions
| Audit question | Control in the factory | Record that answers it |
|---|---|---|
| Who made this change? | A distinct identity per agent, linked to the delegating human | Decision log entries for the agent, and the human who granted it access |
| Who approved it? | Approval on merge, deploy, secrets, and production data | Approval history with approver, outcome, and time |
| Was access least privilege? | Deny by default, workflows per task, trust ceilings set by admins | Policy and workflow configuration; policy as code in Git where you use GitOps |
| Could the author approve its own change? | Merge tools gated by human approval; authorship checks in your services | Approval history and permit.check() decisions on merge |
| How fast can you revoke access? | Revoking a human cascades to every agent acting for them | Revocation events and the next denied call |
| Can you detect misuse? | Denies on off-workflow destinations; intent drift blocks where enabled | Denials grouped by agent, workflow, and destination |
How the controls relate to common frameworks
These are areas where the records above are commonly used as evidence. They are not a complete mapping, and none of these frameworks has criteria written specifically for AI coding agents.
| Framework | Relevant area | Software factory control |
|---|---|---|
| SOC 2 (Trust Services Criteria) | CC6.1 to CC6.3: logical access, provisioning, least privilege | Per-agent identity, trust ceilings, deny by default, revocation |
| SOC 2 | CC7.2: monitoring for anomalies | Denials, approval rejections, and drift events forwarded to your SIEM |
| SOC 2 | CC8.1: change management | Human approval on merge and deploy, with the approver and the authoring agent both recorded |
| ISO/IEC 27001:2022 Annex A | 5.15 access control, 5.16 identity management, 5.18 access rights, 8.2 privileged access rights | Delegated agent identities, trust levels, admin-set ceilings |
| ISO/IEC 27001:2022 Annex A | 8.15 logging, 8.32 change management | Decision log and approval history |
| OWASP Top 10 for Agentic Applications | ASI02 tool misuse, ASI03 identity and privilege abuse | Per-call policy on tools and egress, delegated identity instead of borrowed credentials |
| ISO/IEC 42001 and the EU AI Act | Human oversight and record-keeping expectations for AI systems | Approval checkpoints and the decision log. Whether these obligations apply to your coding agents depends on your use case; confirm with counsel. |
Export the records
- Read gateway decisions in the Permit audit log, and filter by agent user key to collect one agent's activity for a reporting period. See Collect activity for a reporting period.
- Forward PDP decision logs to Elasticsearch or stdout with the Fluent Bit logs forwarder, then into your SIEM. See Forward decision logs.
- Use the Permit API to pull audit logs into your own pipeline.