The change-management evidence your auditor asks for, for AI agents.
A SOC 2 or ISO 27001 auditor wants the same chain of evidence for an agent change as for any other: who made it, that it was tested, that nothing was quietly weakened, and an immutable record it cannot change after the fact. gitta keeps that record for every change an agent makes, mapped to the controls your auditor already checks.
Control crosswalk
Every agent and person is recorded through your own sign-in, so each change names who started it, on which machine, and who merged it.
Risky code and weakened checks are flagged on the line an agent writes them, and changes to agent instruction files, including ones a dependency planted, are reported.
Each change, check and override goes live to your log system, syslog, Splunk, Datadog or your cloud, and waits on the server while a receiver is down.
Every change is tested on the combined work before it reaches main, with the result, the approver and any override on the record. A failed merge stops before main changes.
Every record links to the one before it with a hash, kept on your servers. One command confirms the whole chain is intact, so an edited record shows.
Built for a Type 2 audit, not a snapshot.
A SOC 2 Type 2 auditor wants evidence that a control worked across the whole period, not on the day you were asked. gitta records every agent change as it happens, from the day you set it up, so the evidence is already there for the period under review. Export it as a spreadsheet for your auditor, or as event lines for your log system.
Bring your AI agents into your next audit.
Tell us which frameworks you report on, and we will walk you through the evidence gitta gives you. See the full audit and compliance page and the EU AI Act.
