SOC 2-aligned access control for AI agents

Auditors increasingly treat an agent as a privileged identity. These policies support the most-tested SOC 2 access, boundary, and change-management criteria — with a per-decision audit trail.

For: Teams carrying a SOC 2 report into every security review

A SOC 2 review asks how logical access is restricted (CC6.1/CC6.3), how boundaries hold against new threats (CC6.6), and how change is controlled (CC8.1). An agent is now one of the identities those criteria cover, and the gateway is where you enforce them on its actions — with the decision logged the same way your other audit evidence is.

role-gate-writes restricts write tools to the IdP groups that should hold them, and read-only gives a fail-closed one-way mirror for a lower-trust pilot — both map to least-privilege access. default-deny-unknown-tools denies any tool not on an audited allowlist, so a newly added or renamed upstream tool is blocked until reviewed, which supports the boundary-protection criteria. require-human-approval-merge keeps an agent from consummating a change on its own — it drafts, a human approves.

What it is not: SOC 2 spans control environment, risk assessment, availability, and retention, none of which live on the MCP path. This bundle is the technical access-control evidence for the agent channel — one well-scoped input to the report. Every policy here produces a principal, action, resource, context, decision record that lands in the same audit stream you already collect.