An AI agent can draft contracts, analyze user data, and retrain models faster than any human, but when it queries the wrong table or touches live customer data, things break fast. SOC 2 auditors do not care that the agent was “just learning.” They care about identity, control, and proof.