SOC 2 CC6 / CC7 and ISO 27001 Annex A access controls were designed around human users: provisioned accounts, predictable sessions, and admin actions you can attribute to a person. AI agents break those operating assumptions. A token can be valid at consent time, then an agent chains tools and ...
Source: [Dev.to](https://dev.to/authbyexample1/soc-2-cc6-and-iso-27001-still-assume-humans-agents-break-the-evidence-model-3826)