It appears in SOC 2 change management and access criteria and in ISO 27001 Annex A. Small teams often meet it with peer review, pipeline-only deployments and reviewed administrative access, and agents need the same treatment as people.
The guide to SOC 2 for AI agents covers agent-authored changes.
Read more
Related terms
- Compensating control
- A compensating control is an alternative control that addresses a risk when the expected control cannot be implemented as described.
- Control
- A control is a measure an organization puts in place to manage a risk or meet a requirement, such as an access review, an approval step or encryption.
- Least privilege
- Least privilege is the principle that every user, service and agent gets only the access it needs for its task, and no more.