Agent Compliance Desk

Agent compliance desk

Compliance is expensive because evidence is collected in a panic once a year, when the people who knew have moved on. Continuous collection is dull, scheduled, and rule-bound, which makes it a natural fit for agents and a poor fit for human attention.

Team

• Control mapper: maintains the mapping from each control to the system that satisfies it and the evidence that proves it.
• Evidence collector: gathers the artefact on a schedule and stores it with a timestamp.
• Drift detector: compares current state against the last accepted state and raises differences.

Shape: continuous collection against a control register, with drift escalation.

Method

1. Build the control-to-evidence map first. Each control needs a named system, a named artefact, and an owner. Controls without a defined artefact are the ones that fail an audit.
2. Prefer generated evidence to attested evidence. An exported configuration or access list beats a screenshot, and beats a statement that a policy exists (see audit-logging).
3. Collect on a schedule, not before the audit. Timestamped evidence across the period demonstrates the control operated, which is what auditors test, rather than that it exists today.
4. Detect drift as a first-class event. A policy loosened, an access grant unrevoked, or a job that stopped running is the finding you want in week two, not month eleven.
5. Track exceptions with expiry. Every accepted deviation needs an owner, a reason, and a date it is revisited, or exceptions silently become the standard.
6. Keep evidence access controlled. Compliance artefacts often contain sensitive configuration and personal data (see data-classification).
7. Rehearse the auditor's question. For a sample of controls, try to answer show me from the evidence alone, which is the only real test of the register.

Run it

In Claude Code, keep the control register as a tracked file, run the collector on a schedule writing dated artefacts into an evidence directory, and run the drift detector as a comparison pass that opens findings. Human owners resolve findings. Port to LangGraph with a scheduled collection node and a comparison node raising events.

Signals it works

• Any control can be evidenced from stored artefacts without asking a person.
• Drift is found within days, and exceptions carry expiry dates.
• Audit preparation is a review of existing evidence, not a collection sprint.

Boundaries

This desk gathers and monitors; it does not certify, interpret a framework, or replace an auditor or compliance officer. Whether a control satisfies a requirement is a judgement made by qualified people, and agents must not modify controls, grant access, or alter policy to close a finding.