Use case / Audit readiness

Walk into the assessment with the agent layer already covered.
Not scrambling two weeks out.

You're mid-prep for a SOC 2 Type II window, a HIPAA risk assessment, ISO 42001, or EU AI Act conformity — and your tooling logs humans and infrastructure but goes dark on what the agents did. AIR collects that evidence continuously, so readiness is a posture, not a fire drill.

SOC 2HIPAAISO 42001EU AI Act

Book an agent audit See the evidence ↓

Continuous · always current · mapped to your controls

Assessment-ready · live

Coverageagent layer · continuous

SOC 2CC7.2 / CC7.3 mapped

HIPAA164.312(b) mapped

EU AI ActArticle 12 log

collected in-process · signed · always current

✓ ready today, not in two weeks

01The stakes

T-14 days · auditor kickoff scheduled

Two weeks out, you realize nothing captured what the agents did.

Your GRC stack covers people and infrastructure, but the autonomous agents are a blind spot you're now backfilling under a deadline. With AIR that evidence was already being collected, signed, and mapped to each control while the work happened.

02What "ready" means

Ready is a posture, not a scramble.

Continuous

not retroactive

Evidence is signed in-process the moment each agent acts, so the record exists before anyone asks for it.

No reconstructing the week before the auditor arrives.

The agent layer

the gap others leave

Your existing tools cover humans and infrastructure. AIR fills the agent gap every framework now expects you to close.

14 of the 16 detectors run offline with zero config.

Mapped to the control

not raw logs

Each record maps to the named requirement — SOC 2 CC7.2 / CC7.3, HIPAA 164.312(b), ISO 42001, EU AI Act Art. 12.

The assessor sees coverage, not a data dump.

03How AIR answers

Everything an assessment asks of the agent layer.

Is the agent layer covered for this assessment?

Audit16 detectors read every agent action against OWASP and framework signatures, continuously.

Is the evidence current, or already stale?

ProveSigned in-process the moment each action happens — always assessment-ready.

Does it map to my controls?

ReportOne record → SOC 2 · HIPAA · ISO 42001 · EU AI Act evidence.

Can the assessor trust it wasn't edited?

ProveBLAKE3 + Ed25519, anchored to a public transparency log.

Across every agent and framework at once?

One chainA single signed chain covers them all — no per-framework rework.

04The evidence

Hand the assessor coverage, not a data dump.

A control-mapped, signed, timestamped record of what the agents did — produced in the form an assessor recognizes and can verify independently under FRE 902(13)–(14).

See the framework mapping →

Evidence pack · agent layer

Control · SOC 2 CC7.2 — agent action logging

Action · agent read — in scope, signed

Maps to · HIPAA 164.312(b) · EU AI Act Art. 12

signed in-process · blake3 · ed25519 · anchored Rekor

✓ assessment-ready · verify on search.sigstore.dev

05What you get

The tiers teams in audit prep choose.

Enterprise

most teams here

Continuous agent-layer evidence
Framework reports — SOC 2 · HIPAA · ISO 42001 · EU AI Act
Causal graph, query & replay
SIEM: Splunk · Datadog · Sentinel · Sumo
SSO / OIDC, SLA

Book an agent audit

Air-gapped

regulated · sovereign

Everything in Enterprise, plus

On-prem / offline anchoring
No phone-home — records never leave
Extended retention + PQ re-anchoring
Admissibility Pack — FRE 902 + expert support

Talk to us

Be ready before the auditor schedules the kickoff.

A free agent audit shows exactly where your agent-layer evidence stands today — and what an assessor would find.

Book an agent audit →