AgentTrust Docs

Overview

AgentTrust is designed for ISO/IEC 42001 AI management system alignment, GDPR data subject rights, and SOC2 audit evidence export. This page summarizes compliance features and operator responsibilities.

Why It Matters

Regulated industries require demonstrable governance controls, audit trails, and data retention policies.

Prerequisites

Full edge gateway (not embedded) for production compliance
Enterprise tier for SOC2 export, hash chain, SSO

Step-by-Step Guide

ISO/IEC 42001 alignment

Control area	AgentTrust feature
Intended use (A.8.1)	INTENDED_USE.md
AI impact assessment	AIIA_TEMPLATE.md
Audit trail	Append-only audit ledger
Human oversight	Review queue for escalate/request_evidence
Continuous improvement	Feedback API, adverse impact reporting
Performance monitoring	Analytics, reliability metrics

Policy packs (built-in)

Located in agentrust-edge/gateway/config/policy_packs/:

Pack	Domain
`base.yaml`	General governance
`financial.yaml`	Financial transactions
`hipaa.yaml`	Healthcare
`gdpr.yaml`	EU data protection
`pci_dss.yaml`	Payment card data
`soc2.yaml`	SOC2 controls
`sox.yaml`	Financial reporting
`pii_controls.yaml`	PII detection
`medical.yaml`	Medical devices

Retention: 90-day hot store; metadata 7 years (DATA_GOVERNANCE.md)
PII masking: Within 24 hours of detection
Erasure: DELETE /v1/audit/executions/{id}/pii
Access: GET /v1/audit/executions

SOC2 export (Enterprise)

GET /v1/reports/compliance
GET /v1/reports/audit-pack

Operator responsibilities

Configure policy packs for your domain
Route escalate/request_evidence to qualified reviewers
Complete AIIA before high-risk deployments
Rotate AGENTRUST_JWT_SECRET regularly
Report adverse impacts via POST /v1/feedback/adverse-impact

Prohibited uses

See INTENDED_USE.md §8 — AgentTrust must not be the sole decision-maker for high-stakes irreversible actions without human oversight.

Examples

Enable GDPR policy pack:

Mount policy_packs/gdpr.yaml in gateway config and reference in policy.yaml.

Best Practices

Complete AIIA template before production
Use PII policy pack for customer-facing agents
Run hash chain verification monthly (Enterprise)
Document human review SLAs for escalate outcomes

Common Mistakes

Using default policy packs without domain customization
No human reviewers configured for escalate queue
Processing special-category GDPR data without DPIA

Troubleshooting

See Data Governance and Incident Response.

Compliance