Token Security Says SOC 2 Must Account for AI Agents

Token Security argues that SOC 2 audits should account for AI agents as a distinct identity class. The framework’s technology-neutral criteria can cover agents, but the company says they do not explicitly require organizations or auditors to treat them separately.

That gap can make access reviews misleading. In one example from Token Security, a review records 50 production database queries at 10:03 am under a senior engineer’s name, although the engineer was getting coffee and their agent was making updates.

The company identifies four assumptions behind common access practices: that accounts are approved before creation, have a known owner, identify the actor in logs, and have permissions that indicate their expected work. It says agents can be created as a side effect of actions such as approving an OAuth prompt or adding an MCP server, lack a recorded owner, use borrowed credentials, and act according to instructions and context that change.

Token Security also says three SOC 2 controls can be weakened by these gaps, including offboarding. Agents tied to departing employees may continue running through OAuth grants or API keys. The company cites a study with Cloud Security Alliance that found more than two-thirds of organizations cannot clearly distinguish AI agent actions from human actions. Token Security says SOC 2 should adapt to these risks to avoid becoming outdated.