Hi everyone. I recently passed our SOC 2 Type I with our agent runtime in scope. The biggest headache was proving our logging covered the relevant trust services criteria.

Our agents are built on NanoClaw. I built a simple internal dashboard that maps NanoClaw's audit event types (like `agent.invocation`, `tool.execution`, `session.updated`) directly to the SOC 2 control IDs they help satisfy. It's just a Flask app with a lookup table.

For example, when an auditor asked for evidence of change detection, I could show that `agent.updated` events map to CC6.8. For security monitoring, `tool.execution` failures map to CC7.3.

I'm sharing it in case it helps others. It's not fancy, but it saved us during the audit. The mapping was the hard part. Has anyone else tried something similar for ISO 27001 Annex A controls? I'm worried about gaps for things like "Information transfer" when agents call external APIs.