Skip to main content
Gartner® adds agentic AI to the Global Attack Surface Grid.
SecureAuthSecureAuth

Compliance & Risk Assessments

Audit-ready evidence for every AI agent

Compliance & Risk Assessments shows whose agents reach your most regulated services and how much they can change: five pillars built as one system, from risk rankings to audit-ready evidence.

  1. In-console assessments
  2. NHI Exposure Review
  3. AI Agent Risk Assessment
  4. Compliance packs
  5. Audit-ready evidence

At a glance

What's in Compliance & Risk Assessments

Why it's different

The evidence already exists when auditors ask

Every agent action is written to a tamper-proof audit trail as it happens, with the person it was done for, so nobody has to reconstruct what an agent did after the fact.

  • Each action logs the agent ID, delegating user ID, tool name, parameters, timestamp and result
  • The trail is tamper-proof
  • Redactions are logged as counts only, never the matched text

Pillar 1 · In-console assessments

Start reviews where the risk is highest

Two assessments in Agent Authority rank the identities whose agents carry the most risk, so your compliance team knows where to look first.

  • Agent Access lists first the identities whose agents reach the most regulated services
  • Every service reached, its data class, the tools used inside it and how many calls were sensitive
  • Agent Risk ranks identities by how much their agents can change
  • Whether an identity holds a complete exfil path, and which of its tools can create, update, delete, send out or administer
  • The identity's agent instances, tool executions, tokens, sessions, models and cost at a glance
The Agent Access tab for one identity in the Agent Authority console: every service the agents owned by this identity reached, and the tools used inside it. 20 services reached across 3 data classes plus 12 unclassified, 2 of them regulated, 415 sensitive calls of 1,736, and 2 services at the top severity, Critical. A table of the services where a sensitive tool was used lists each service, its data class, the tools used, calls and severity: microsoft365-graph and salesforce, Regulated and Critical; claude-in-chrome and github, Confidential and High; and slack, Internal and Medium.
From the Agent Authority console
One identity's overview in the Agent Authority console, on the Agent Risk tab. A strip of totals with their change: 2 agent instances, 231 tool executions, 619.8M total tokens, 31 sessions, 4 models used and a cost of 246 USD. Below, how far this identity's delegation reaches and what it can change: exfil path 3 of 3 legs, flagged as holding a complete exfil path; 15 of 72 services in the org reached; 5 of those 15 write-capable; 1,011 of 1,878 calls through tools that can change data; and about 31 sessions. A table of every tool the identity called, such as Bash, slack_read_thread and update_plan, with its service, its data class such as Confidential, Internal or Unclassified, marks for whether it can create, update, delete, send out or administer, and its number of calls.
From the Agent Authority console

Pillar 2 · NHI Exposure Review

Know every non-human identity you're accountable for

A SecureAuth solutions engineer runs a one-off, read-only review of the systems you choose, then hands over a prioritized findings report: what exists, who owns it, what it can reach, and what to fix first.

  • Your identity provider, cloud accounts, code repositories and SaaS apps
  • Service accounts, API keys, tokens and their owners, plus every AI agent connected through Agent Authority
  • Exposures ranked by severity: never-expiring secrets, over-privileged and ownerless identities, agent sprawl
  • The first policies to put in place

Pillar 3 · AI Agent Risk Assessment

See what agents are doing before you set a single rule

Switch on the telemetry feature your AI platforms already offer and point that feed at us. It takes 10 minutes, it's read-only and nothing is installed. The assessment observes; it never sits in your agents' path.

  • An agent inventory, with the owner behind each agent
  • An activity map and the flow from your people to their agents
  • Where risk and token spend concentrate
  • The first control to put in place

Pillar 4 · Compliance packs

Map every safeguard to the framework you're audited against

Compliance packs map gateway safeguards to the controls of the frameworks you are audited against, so you can see which controls the gateway already evidences and which it doesn't enforce yet.

  • Packs for SOC 2, HIPAA, GDPR and PCI DSS, plus the EU AI Act (pack v0.9)
  • For the EU AI Act, most gateway support is evidence: logs, oversight and monitoring
  • Generate an evidence report for any pack
The Packs tab of Compliance in the Agent Authority console: compliance packs map gateway safeguards to the frameworks you are audited against. Five packs, each with an Open pack button: SOC 2 with 12 controls, HIPAA with 12, GDPR with 8 and PCI DSS with 12, each pack v1.0, and the EU AI Act with 7 controls, pack v0.9, where most gateway support is evidence: logs, oversight and monitoring. A Generate report button sits beside the pack picker.
From the Agent Authority console

Pillar 4 · Compliance packs

See which controls are evidenced, and import what's missing

Open a pack to see each control, the safeguard behind it and whether it is evidenced today.

  • Each control lists the gateway safeguards that would enforce it, such as masking card numbers in responses
  • A status for every control: Evidenced or Not enforced
  • The coverage score counts built-in evidence only
  • Import any missing safeguard from the pack, one at a time or all at once
The PCI DSS v4.0.1 pack, pack v1.0, at 27%: 3 of 11 controls covered. A note says it is not in use yet, the score counts built-in evidence only, and importing any safeguard below adds PCI DSS to the packs in use. The controls list, with a Select all 8 not imported button, shows each control with the safeguard that would enforce it, such as 3.4.1 Mask PAN when displayed with Mask card numbers in responses, 4.2.2 with Block card numbers in outbound tool calls, 7.2.5 with Deny destructive tools and 8.6.2 with Block and redact credentials, all Not enforced, and 8.2.1 Unique ID for every user, Evidenced.
From the Agent Authority console

Pillar 5 · Audit-ready evidence

Hand auditors the record, not a reconstruction

Generate an evidence report for a framework and a period, and hand it over as it was recorded.

  • A summary: coverage of the assessed controls, controls enforced by active safeguards, violations prevented and controls with open items
  • A control matrix: each requirement, its status and the gateway safeguards behind it
  • Controls outside the gateway are marked Organizational
  • A compliance-ready export for your auditors
An AI Agent Control Evidence report for HIPAA, for the sample organization Acme Health, covering Jul 1 to Sep 30, 2026, pack HIPAA v1.0. The summary: 36% coverage of 11 assessed controls, 0 controls enforced by active safeguards, 0 violations prevented in the period and 7 controls with open items. The control matrix lists each control ID and requirement with its status and gateway safeguards: information system activity review and audit controls are Evidenced by Agent Trail recording every tool call, built in; unique user identification and person or entity authentication are Evidenced by a unique identity per agent instance and user, built in; access control, integrity and transmission security are Not enforced, with their safeguards not imported; security awareness and training is Organizational, outside the gateway.
A generated HIPAA evidence report (sample organization)

Related capabilities

Go deeper on what these assessments draw on

See how the whole product fits together, or start with the capabilities below.

Compliance & Risk Assessments FAQ

What is Compliance & Risk Assessments?

Compliance & Risk Assessments shows whose agents reach your most regulated services and how much they can change. It brings five pillars together as one system: in-console assessments (Agent Access and Agent Risk), the read-only NHI Exposure Review, the AI Agent Risk Assessment, compliance packs that map gateway safeguards to the frameworks you're audited against, and an evidence report for your auditors.

What do the Agent Access and Agent Risk assessments show?

Agent Access lists first the identities whose agents reach the most regulated services. Agent Risk ranks identities by how much their agents can change: whether an identity holds a complete exfil path, how many of the services it reaches are write-capable, and every tool it called with the service's data class and whether that tool can create, update, delete, send data out or administer. Your compliance team knows where to look first.

Does the NHI Exposure Review change anything it reviews?

No. A SecureAuth solutions engineer runs a one-off, read-only review of the systems you choose, such as your identity provider, cloud accounts, code repositories and SaaS apps. It reads and reports: you get a prioritized findings report of what exists, who owns it, what it can reach, and the first policies to put in place.

How long does the AI Agent Risk Assessment take, and what does it report?

Setup takes about 10 minutes. You switch on the telemetry feature your AI platforms already offer and point that feed at SecureAuth. It's read-only, nothing is installed, and it never sits in your agents' path. The report covers an agent inventory with the owner behind each agent, an activity map, the flow from your people to their agents, where risk and token spend concentrate, and the first control to put in place.

Which compliance frameworks does it map to?

Agent Authority ships compliance packs for SOC 2, HIPAA, GDPR, the EU AI Act and PCI DSS. Each pack maps the framework's controls to gateway safeguards and shows which are evidenced and which are not enforced. The EU AI Act pack is version 0.9, and most gateway support there is evidence: logs, oversight and monitoring. A pack's coverage score counts built-in evidence only; import any missing safeguard from the pack, then generate an evidence report for your auditors. Controls such as security awareness training are marked organizational, outside the gateway.

What does the audit trail record for each agent action?

Each action logs the agent ID, the delegating user ID, the tool name, the parameters, a timestamp and the result, in a tamper-proof audit trail with a compliance-ready export for your auditors. Redactions are logged as counts only; the matched text is never recorded.

Have the evidence ready before auditors ask

14-day free trial. Your own Agent Authority tenant.

Start free trial