---
title: "Controls and evidence · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/controls-and-evidence
updated: 2026-10-20
licence: "All rights reserved"
---

# Controls and evidence

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Turn each policy into controls with an owner and an automated check. Map them to SOC 2 or ISO 27001 and collect dated evidence from CI and the cloud.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence`.

## Required

- [Turn every policy line into a checked control](https://agentwranglers.se/playbook/compliance/controls-and-evidence/control-register): Keep a register of controls in the repository. Each control has an ID, one testable statement, an owner, a frequency and the command that checks it.
- [Collect evidence automatically](https://agentwranglers.se/playbook/compliance/controls-and-evidence/automated-evidence): Let scheduled jobs collect evidence for each automated control from CI, the code host and the cloud. Save each result with a date and a hash.
- [Keep evidence where nobody can change it](https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store): Store evidence in write-once storage, in folders by date, and keep it for the audit period plus at least one year.
- [Prove every production change was reviewed](https://agentwranglers.se/playbook/compliance/controls-and-evidence/change-evidence): For every production deploy, keep a link to the commit, the pull request, an approval by someone other than the author, and the passing checks.
- [Keep every policy short and owned](https://agentwranglers.se/playbook/compliance/controls-and-evidence/policies-owned): Give every written policy an owner, a version, an approval date and a review date within 12 months. Track that every person has read the current version.
- [Keep a risk register with treatment dates](https://agentwranglers.se/playbook/compliance/controls-and-evidence/risk-register): Keep a register of security and privacy risks as data. Give each risk a likelihood, an impact, an owner, a treatment and a review date within 12 months.

## Recommended

- [Pick the framework your customers ask for](https://agentwranglers.se/playbook/compliance/controls-and-evidence/framework-choice): Choose SOC 2 or ISO/IEC 27001 from what your customers ask for in contracts and questionnaires, and record the auditor and the next audit date.

- Previous: [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)
- Next: [AI Act](https://agentwranglers.se/playbook/compliance/ai-act)
- [All chapters](https://agentwranglers.se/playbook/compliance)