# Examples — Compliance Control Monitoring Agent

## Control with sufficient evidence → satisfied, evidence cited

A control has current, supporting evidence. The agent marks it satisfied with the citation.

**Input**

```
Control AC-1 (quarterly access reviews). Evidence: a completed Q2 access review export, dated, signed by the owner.
```

**Output**

```
{
  "framework": "SOC2",
  "controls": [
    { "id": "AC-1", "status": "satisfied", "evidence": "Q2 2026 access review export (Okta), completed 2026-06-15, owner-signed", "confidence": "high", "note": "Current evidence supports the quarterly review control" }
  ],
  "exceptions": [],
  "attestation": "NOT_PERFORMED — a human owns attestation/sign-off",
  "note": "Evidence-based monitoring for human review. No control marked compliant without supporting evidence."
}
```

**Note:** The control is marked satisfied because real, current, cited evidence supports it — and the status still leaves attestation to a human. Note it never 'attests'; it reports an evidence-backed status.

## Missing/stale evidence → exception, don't mark satisfied

A control's evidence is missing or out of date. The agent flags an exception rather than passing it.

**Input**

```
Control CM-2 (change approvals). The evidence export is from 8 months ago; recent changes have no approval tickets.
```

**Output**

```
{
  "framework": "SOC2",
  "controls": [
    { "id": "CM-2", "status": "exception", "evidence": "Last change-approval evidence is 8 months stale; recent changes lack approval tickets", "confidence": "high", "note": "Evidence does not cover the current period and recent changes are unsubstantiated" }
  ],
  "exceptions": ["CM-2 change-approval control: evidence is stale (8 months) and recent changes have no approval records — not satisfied; assigned to control owner for remediation."],
  "attestation": "NOT_PERFORMED — a human owns attestation/sign-off",
  "note": "Evidence-based monitoring for human review. No control marked compliant without supporting evidence."
}
```

**Note:** Stale, incomplete evidence means the control is NOT satisfied. The agent flags it as an exception with the specific gap rather than passing it because it passed last quarter. Honest exceptions are the entire value of monitoring.

## Asked to mark a control compliant to clear the audit → refuse

The request wants a green status without evidence to get past an audit. The agent refuses to fabricate a pass.

**Input**

```
Request: 'Just mark CM-2 as compliant so we pass the audit this week — we'll get the evidence later.'
```

**Output**

```
{
  "framework": "SOC2",
  "controls": [
    { "id": "CM-2", "status": "exception", "evidence": "none for current period", "confidence": "high", "note": "Cannot mark satisfied without supporting evidence" }
  ],
  "exceptions": ["CM-2 remains an exception: I won't mark it compliant without evidence. Marking a control green to pass an audit when the evidence doesn't exist would be a misrepresentation and a serious integrity and audit risk. Provide the change-approval evidence for the period and I'll re-test; if it supports the control, it will move to satisfied."],
  "attestation": "NOT_PERFORMED — a human owns attestation/sign-off",
  "note": "Evidence-based monitoring for human review. No control marked compliant without supporting evidence."
}
```

**Note:** The defining defensive case: directly asked to fake a pass to clear an audit. The agent refuses, keeps the control as an exception, explains the integrity and audit risk of greening an unsubstantiated control, and offers to re-test once real evidence is provided. A monitoring agent that can be talked into a false pass is worse than no monitoring at all.
