ControlLoopStart free trial

Show your auditor what every agent could do, and who approved it

Adopting coding agents raises the question every auditor and enterprise customer now asks: what can your agents do, who decided, and how do you know? ControlLoop answers with evidence generated from the gate itself.

Start free trial Get the CLI on GitHub

Team: 7 days free, then $199 a month per organization. Cancel any time. Compare plans →

Agent governance you can't show is governance you don't have

A SOC 2 change-management review asks the same questions every time: what ran, what the gate decided, which policy was in force, which risks you accepted, and who changed the rules. For AI agents, most teams answer with screenshots and memory.

Security questionnaires now ask about AI agents directly. Without an inventory and a history of approved changes, the honest answer is that nobody knows.

What the report contains
Example evidence report · SOC 2 audit window
  Period          2026-07-01 to 2026-09-30
  Gate timeline   every scan, verdict, commit, and policy version
  Exceptions      owner, reason, approver, and expiry for each
  Agent inventory agents, data classes, and components in scope
  Controls        SOC 2 CC8.1 · ISO/IEC 42001 8.1 · OWASP ASI04
  Integrity       SHA-256 digest over the exported JSON

What ControlLoop reports

One report, three renderings

The on-screen view, the JSON export, and the PDF are the same stored report, so they cannot disagree, and a report reads the same a year later.

Mapped to the frameworks you're audited against

Sections are mapped to SOC 2 CC6.1, CC6.8, and CC8.1, ISO/IEC 42001 clause 8.1, the OWASP Top 10 for Agentic Applications, and the CSA AI Controls Matrix.

Verifiable after the fact

Each report carries a SHA-256 digest of its JSON export, and it never contains source code, prompts, or secret values.

How it works

  1. 01

    Gate as you build

    Every scan, verdict, exception, and approval is recorded as it happens, with the policy version that judged it.

  2. 02

    Pick the window

    Choose the repositories and the audit period, up to 400 days, and generate a report.

  3. 03

    Hand it over

    Export JSON or PDF, or copy a control's evidence as a paragraph for a security questionnaire.

Questions

Does ControlLoop make us SOC 2 or ISO/IEC 42001 compliant?

No. ControlLoop provides evidence for the mapped controls. It does not attest compliance with any framework; your auditor decides what the evidence demonstrates.

Is the evidence report part of the free CLI?

Evidence reports, the audit log, and the agent inventory across repositories are part of Team. The free CLI writes an evidence artifact for each gate run.

Can a report change after it is generated?

No. A report is a stored snapshot. A later scan or a revoked exception does not change it; generate a new report to include newer activity.

Go deeper

Read the guide: What is an Agent Capability Bill of Materials (ACBOM)?

More use cases