Letting AI Agents Collect Compliance Evidence, Safely

Much of compliance work is retrieval: export the user list, screenshot the branch protection settings, find last quarter’s access review. That is exactly the kind of work AI agents are good at, provided they can reach the systems involved. The Model Context Protocol (MCP) is the open standard for that connection.

How MCP tool calls work

An MCP server describes its tools with names and JSON schemas. An MCP client, such as Claude, Cursor, or your own agent, lists the tools, decides which to call, and sends a JSON-RPC tools/call request. The server runs the tool and returns the result.

{
  "jsonrpc": "2.0",
  "id": 7,
  "method": "tools/call",
  "params": {
    "name": "evidence_collect",
    "arguments": { "control": "CC6.1", "source": "okta" }
  }
}

What can go wrong

• Over-broad tokens: an agent given an admin token can do anything an admin can.
• Prompt injection: tool results are untrusted text. A document or ticket can contain instructions that try to redirect the agent.
• Unreviewed writes: an agent that can change a policy or close a finding can quietly weaken your controls.
• Missing attribution: if calls are not logged, you cannot show an auditor who did what.

Controls that make it safe

1. Scope every token to an explicit list of tools, and make it expire. Read-only by default.
2. Separate read tools from write tools, and require a person to approve any write.
3. Treat everything a tool returns as data, never as instructions to follow.
4. Check each call against policy at runtime, before it executes.
5. Log every call with the agent, the person it acted for, the arguments, and the result.

With those controls, agents can do the tedious part (collecting, comparing, drafting) while people keep the decisions. The log of tool calls itself becomes useful evidence of how controls are operated.