{"slug": "soc-2-cc6-and-iso-27001-still-assume-humans-agents-break-the-evidence-model", "title": "SOC 2 CC6 and ISO 27001 still assume humans — agents break the evidence model", "summary": "Permit.io published a practical checklist mapping SOC 2 CC6/CC7 and ISO 27001 Annex A access controls to AI agents, arguing that existing compliance evidence models assume human users with provisioned accounts and attributable sessions. The company notes that OAuth answers whether a client can use a token but not whether a specific agent should call a given tool on a given resource for a given user at that moment.", "body_md": "SOC 2 **CC6** / **CC7** and ISO 27001 Annex A access controls were designed around human users: provisioned accounts, predictable sessions, and admin actions you can attribute to a person.\n\nAI agents break those operating assumptions. A token can be valid at consent time, then an agent chains tools and produces side effects the quarterly user-access review never sees. OAuth still answers \"can this client use this token?\" — it does not fully answer \"should this agent, for this user, call this tool on this resource right now?\"\n\nUseful evidence for agentic systems usually needs:\n\nWe published a practical CC6 / ISO 27001 checklist for AI agents (I'm with Permit.io):", "url": "https://wpnews.pro/news/soc-2-cc6-and-iso-27001-still-assume-humans-agents-break-the-evidence-model", "canonical_source": "https://dev.to/authbyexample1/soc-2-cc6-and-iso-27001-still-assume-humans-agents-break-the-evidence-model-3826", "published_at": "2026-10-01 08:39:10+00:00", "updated_at": "2026-10-01 08:44:17.915435+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy"], "entities": ["Permit.io", "SOC 2", "ISO 27001", "OAuth"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/soc-2-cc6-and-iso-27001-still-assume-humans-agents-break-the-evidence-model", "markdown": "https://wpnews.pro/news/soc-2-cc6-and-iso-27001-still-assume-humans-agents-break-the-evidence-model.md", "text": "https://wpnews.pro/news/soc-2-cc6-and-iso-27001-still-assume-humans-agents-break-the-evidence-model.txt", "jsonld": "https://wpnews.pro/news/soc-2-cc6-and-iso-27001-still-assume-humans-agents-break-the-evidence-model.jsonld"}}