# Compliance Control Monitoring Agent

> A compliance agent that tests internal controls against real evidence, flags failures and missing evidence, and never marks a control compliant without proof.

- **Category:** Compliance & Risk
- **Difficulty:** Advanced
- **Setup time:** 45 min
- **Stacks:** Claude, LangGraph, OpenAI
- **Version:** 2.0.0 (updated 2026-06-21)
- **Source:** https://agent-kits.com/kit/control-monitor

## Overview

Tests internal controls against the evidence that should support them.

Produces an honest, evidence-cited status for each control.

Flags failing controls and missing evidence instead of marking them compliant.

Defensive: never fabricates a pass, never auto-attests, and escalates exceptions to a human.

## When to use it

- You monitor a set of controls and want continuous, evidence-based status.
- You want missing evidence and failures flagged honestly, not smoothed over.
- You want each control status tied to citable evidence.
- You want a human to own attestation while the agent does the legwork.

## When not to use it

- You want it to attest or sign off on compliance — it won't.
- You want controls marked passing to clear an audit without evidence.
- You have no evidence sources for it to test against.
- You need legal compliance determinations (it supports, it doesn't advise).

## Architecture

- **Control intake** — Takes the set of controls to monitor and the framework they belong to.
- **Evidence collector** — Gathers the evidence each control depends on from the configured sources.
- **Control tester** — Tests whether the evidence actually exists, is current, and supports the control.
- **Evidence guard** — Blocks any 'satisfied' status that isn't backed by supporting evidence, preventing fabricated passes.
- **Exception flagger** — Flags failing controls, missing or stale evidence, and exceptions honestly with the specific gap.
- **No-attest gate** — Produces status and exceptions for review but never attests, certifies, or signs off compliance.
- **Status reporting** — Reports each control's status with cited evidence, confidence, and escalations for a human.

## Files in this bundle

- `system-prompt.md` — the agent's system prompt
- `tools.json` — tool/function definitions the agent expects
- `workflow.md` — step-by-step run loop
- `.env.example` — environment variables to fill in
- `kit.json` — full structured metadata
- `starters/` — minimal starter snippets
- `LICENSE` — Apache-2.0 (code, configuration, and schema)
- `LICENSE-CONTENT` — CC BY 4.0 (specification text and documentation)
- `NOTICE` — attribution and trademark notice
- `run.py` — **runnable demo**: real agent loop with mock tools (`pip install anthropic`, set `ANTHROPIC_API_KEY`, `python run.py`)
- `agentaz.json` / `agentaz.schema.json` — AgentAz™ governance spec + schema

## Implementation notes

- Mark a control satisfied only with real, current, supporting evidence; a fabricated or evidence-free pass is a misrepresentation with serious audit and legal consequences.
- Report failures and missing/stale evidence honestly and never downgrade severity to avoid findings — surfaced exceptions are the entire point of monitoring.
- Cite the specific evidence behind every satisfied status so the status is verifiable and defensible.
- Never auto-attest or certify compliance; produce status and exceptions for a human to attest, keeping the legal determination with a person.
- Flag stale evidence explicitly, since a control that passed last period isn't satisfied now without current evidence.
- Keep a clear audit trail of tests, evidence, and exceptions for the eventual auditor.
- A cheaper model can collect and match evidence; reserve the strong model for testing whether evidence actually supports a control.

## Variations

- **Basic — Control checker:** Tests controls against evidence and reports satisfied/exception status with citations. On demand.
- **Advanced — Evidence-guarded monitoring:** Adds stale-evidence flagging, exception handling, no-fabricated-pass and no-attest guards, and escalation to owners.
- **Enterprise — Continuous GRC monitoring:** Adds evidence-source integration, framework mapping (SOC2/ISO/etc.), scheduled testing, audit trails, and remediation workflows — humans attest.

## FAQ

**Will it mark a control compliant to pass an audit?**

No — that's its core constraint. A control is only 'satisfied' when real, current evidence supports it. It won't green an unsubstantiated control to clear an audit, because that's a misrepresentation with serious integrity and audit risk.

**Does it attest or sign off compliance?**

No. It gathers and assesses evidence and reports status, but a human owns the attestation and sign-off. It never certifies compliance or makes the legal determination.

**How does it handle missing or stale evidence?**

It marks the control as an exception or insufficient-evidence rather than satisfied, states the specific gap (for example, evidence eight months old), and routes it to the control owner. It won't pass a control on the strength of last period's evidence.

**Is every status backed up?**

Yes. Every satisfied status cites the specific evidence that supports it, so the result is verifiable and defensible to an auditor.

**Does it give legal compliance advice?**

No. It supports your GRC work with evidence-based monitoring; it doesn't provide legal or regulatory determinations, which remain with your compliance and legal teams.

**Can it monitor continuously?**

Yes. It can run on a schedule against your evidence sources, surfacing new exceptions and stale evidence over time, with a full audit trail for the eventual review.


---

© 2026 AgentKits · www.agent-kits.com

**Open source.** Code, configuration, and the AgentAz™ schema are licensed under
**Apache-2.0**; specification text and documentation under **CC BY 4.0** (with
attribution to AgentKits, link to https://www.agent-kits.com). See LICENSE, LICENSE-CONTENT,
and NOTICE in this bundle. "AgentAz" and "AgentKits" are trademarks of AgentKits.

**Flagship reference blueprint.** View the source, AgentAz™ spec, and frozen v1.0 schema
in the public registry: https://github.com/agent-kits/agentaz
Original: https://agent-kits.com/kit/control-monitor
