What evidence do auditors ask for on AI agent controls?

Auditors ask for records that a control operated, not descriptions of a control that exists. For AI agents the recurring requests are: the system inventory, the risk and impact assessments, the production approval record with a named approver, dated adversarial testing results, exported guardrail configuration, a sample of runtime logs, the agent's permission scope and its review history, incident records, supplier agreements for model providers, and change management records for model and prompt versions.

Three of these consistently fail. Dated testing results fail because teams tested once at launch and cannot produce anything since, while the model version has changed twice. Permission scope review fails because nobody owns it, and the agent's tool access has expanded through configuration changes that generated no approval. Runtime logs fail because they exist in a vendor console with thirty-day retention and cannot be produced for the audit period.

The question that catches most programs off guard is provenance of the human oversight claim. If your documentation states a human reviews consequential outputs, the auditor will ask for evidence of reviews, including cases where the human disagreed. A review process with a one hundred percent approval rate reads as rubber-stamping and gets treated as an absent control.

Change management is the other gap. A prompt change alters system behavior as materially as a code change, and most organizations version code and not prompts.

Akto Argus produces continuous testing records and runtime enforcement logs against agentic and LLM applications, which are the two evidence classes teams most often reconstruct manually before an audit.

Design the control to emit its own evidence. Anything reconstructed later gets scrutinized as reconstructed.