Expect auditors to ask five things about AI agent access: which agents exist, what each can do, who approved it, how you know what it did, and how often you review it. Bring an inventory, manifests, change records, tool call logs and review minutes. This is a prep guide, not legal advice.
The questions and the evidence
| Question | Evidence that answers it |
|---|---|
| Which agents run in your environment? | Agent registry with owner, purpose, environment |
| What can each agent do? | Tool permission manifest, with scopes and limits |
| Who approved that access? | Change records: pull request approvals or tickets with named approver |
| What did the agent actually do? | Tool call logs tied to the agent identity |
| Are permissions reviewed? | Review minutes, removed grants, dated sign off |
| What stops an agent exceeding its access? | Test results showing a blocked call at a named layer |
Auditors differ in scope and framework, so check what yours expects. The pattern holds across most access control reviews: an inventory, a policy, evidence of approval, evidence of operation and evidence of review.
Steps to prepare
- Build the registry first. If you cannot list your agents, every other answer is shaky.
- Make sure each agent has its own identity. Shared accounts make the log useless for attribution.
- Export a sample: five recent permission changes with approvals, and one month of tool calls for one agent.
- Run a blocked call test and save the output.
- Hold a review, write minutes, and show at least one permission removed.
- Write a one page summary of the design so the auditor does not reconstruct it from raw files.
What logs should hold
The MCP specification says clients should log tool usage for audit purposes. Make sure each record has the agent, tool, arguments summary, result and time. Keep secrets out of logs.
Typical findings to avoid
Approvals by the requester, agents using a developer's personal token, tool lists that differ from the documented list, and review meetings with no outcome. All four are cheap to fix before the audit.
Be accurate about status
Describe controls you operate today. If a review process is new, say when it started. Do not describe any certification or attestation as complete unless it is. Auditors value plain, dated statements.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Quick check
What is the most important single artifact?
The agent registry. Every other answer starts from knowing which agents exist and who owns them.
Do I need a separate process for agents?
Often you can extend your existing access review to cover them, if each agent has its own identity and owner.
Sources
Last reviewed: 19 October 2026.
