Use cases/SOC 2 and EU AI Act evidence from the record

SOC 2 and EU AI Act evidence from the record

PlannedLDG-2289PromptComputeRepoOpsAI Source of TruthPromptReports

In the plan as compliance-mapping (LDG-2289). The mappings to SOC 2 change management and EU AI Act Articles 12, 19 and 50 are Planned. This is evidence for an auditor, not a certification.

Use case

SOC 2 and EU AI Act evidence from the record: a workflow across PromptCompute, RepoOps, AI Source of Truth, PromptReports that starts from quarterly, or when an auditor asks.

Who would use it

Compliance leads preparing for an audit of systems where AI agents act.

What value it provides

Record events mapped to the controls an auditor asks about, exported on a schedule, each event signed.

Why it matters to the user

The evidence collects itself as the work happens, so the audit is a review instead of a scramble.

The problem

Auditors ask for logs of what AI systems did and proof that people oversaw them. Teams export them by hand, every year.

Expected outcomes

Controls with evidence attached
Hours of manual evidence collection per audit

Each run records its outcome as met, not met or not measured.

How it runs

1. Read the signed approval ledgerPromptComputeBuilt

2. Read tasks, events and outcomesRepoOpsBuilt

3. Map events to controlsPromptReportsPlanned

4. A person approves the exportPromptComputeBuilt

5. Record the export's hashAI Source of TruthProposed

Products and connections

Product	Role in this workflow	Docs
PromptCompute	Read the signed approval ledger; A person approves the export	Reference · PromptCompute docs
RepoOps	Read tasks, events and outcomes	Reference · RepoOps docs
AI Source of Truth	Record the export's hash	Reference · AI Source of Truth docs
PromptReports	Map events to controls	Reference · PromptReports docs

Outside the family: Your auditor's evidence portal (optional).

What a person approves

Action	Default risk
`data.export.bulk`	high

Action keys are from the PromptCompute catalog.

How to access it from an agent

An agent will run this workflow through the PromptReports MCP server or API, with an ID agent token. The runner will then call each product for it. Proposed

// MCP: https://mcp.promptreports.ai/mcp (Proposed)
start_run({
  workflow: "audit-evidence",
  inputs: { "framework": "SOC 2 change management", "period": "2026 Q4" },
  dry_run: false
})
// returns { run_id, status: "running", approvals_url }
get_run({ run_id })   // poll, or subscribe to run events

curl -X POST https://api.promptreports.ai/v1/runs \
  -H "Authorization: Bearer $PROMPTREPORTS_AGENT_TOKEN" \
  -d '{"workflow":"audit-evidence"}'

Or call the products yourself, step by step:

Product	Endpoint	Tools
PromptCompute	`https://mcp.promptcompute.ai/mcp`	`request_approval` `get_approval` `cancel_approval` `answer_approver`
RepoOps	`https://mcp.repoops.ai/mcp`	`search_brain` `get_pre_edit_context` `propose_brain_entry` `get_incident_attribution`
AI Source of Truth	`https://aisourceoftruth.com/v1/family/facts`	to confirm
PromptReports	Proposed	through the runner

Set it up

Sign in at app.promptreports.ai with PromptReports ID, and pick your org.
Connect PromptCompute, RepoOps, AI Source of Truth on the Connections page. Link Your auditor's evidence portal (optional) through the product that uses it.
Register the agent that will run it on the Agents page, and give it a version manifest.
Set the approval policy for data.export.bulk. Start with Require approval; critical actions are never auto.
Fill in the inputs (Framework, Period) and choose the trigger: quarterly, or when an auditor asks.
Start a dry run. It will count no workflow request, and it shows which steps would record missing evidence.
Start the run. Approve each gate in the approvals inbox, then read the signed record when it ends.