sipi.bot · compliance
SOC 2 compliance for AI agent spend
SOC 2 requires auditable financial controls over automated spending. Every agent-triggered transaction must be governed by a documented policy, logged with tamper-evident evidence, and subject to review. Here is how sipi.bot maps to SOC 2 CC5-CC7.
What SOC 2 requires for agent spend
SOC 2 Trust Services Criteria CC5, CC6, and CC7 apply to agent spend: every transaction must have a policy-defined approval gate, an immutable audit log, and a human-in-the-loop escalation path. sipi.bot maps to CC5 by enforcing deterministic evaluation; CC6 by key-scoped agent access; CC7 by tamper-evident decision logging.
How sipi.bot maps to SOC 2 controls
| Requirement | sipi.bot capability | Evidence |
|---|---|---|
| Documented policy gate | evaluate_spend in <5ms against rules | Policy version per decision |
| Immutable audit log | Tamper-evident decision log | Full JSON audit trail |
| Human escalation | FLAGGED → approval queue | Queue history with reviewer ID |
| Access control | Agent-key-scoped policies | Auth + authorization log |
Frequently asked questions
What does SOC 2 require for agent spend?
A documented, enforced policy gate on every autonomous transaction, with an immutable audit trail and human escalation. sipi.bot evaluates every transaction against your rules in <5ms, logs the decision with policy version, and queues flagged transactions for human review.
Is sipi.bot certified for this?
sipi.bot is not a certifying body. It provides the technical controls — deterministic evaluation, audit logging, human escalation — that satisfy these governance requirements. Your auditor maps these to the framework criteria.
How do I produce audit evidence?
The sipi.bot audit log exports every decision (transaction, amount, merchant, rule triggers, verdict, policy version, timestamp) as structured JSON. This log is tamper-evident and can be fed into SOC 2, ISO 27001, or GDPR audit trails.