SOC 2 compliance for AI agents: how Sentinel maps to 30+ controls

Enterprises wont adopt AI agents without compliance. SOC 2 is the standard. I mapped every Sentinel security layer to specific SOC 2 controls.

Why this matters

If a company wants to use MarketNow in production, their security team asks: Does this meet SOC 2?

Before today, the answer was we think so but we havent documented it.

Now the answer is: here is the exact mapping.

The mapping

Sentinel 10 layers map to 7 SOC 2 Trust Services Criteria:

CC1 Control Environment

• /trust page demonstrates commitment to ethics (CC1.1)
• Open source peer review program (CC1.4)
• Git history = accountability audit trail (CC1.5)

CC2 Communication

• /api/security endpoint for internal comms (CC2.1)
• /trust + dev.to for external comms (CC2.2)
• GitHub issue #9 incident response (CC2.3)

CC3 Risk Assessment

• L1.5-L1.9 identify risks in 10 categories (CC3.1)
• Sentinel score 0-10 quantifies risk (CC3.2)
• Auto-quarantine responds to critical risk (CC3.3)
• L3 continuous monitoring assesses new risks (CC3.4)

CC4 Monitoring

• Weekly batch audits via GitHub Actions (CC4.1)
• WAF + honeypot detect attacks in real-time (CC4.2)

CC5 Control Activities

• 10-layer defense-in-depth (CC5.1)
• All layers deployed in production (CC5.2)
• WAF 40 rules = IT controls (CC5.3)

CC6 Access Controls

• ATC Ed25519 identity verification (CC6.1)
• CA keypair authentication (CC6.2)
• Mandates pre-approved spending limits (CC6.3)
• WAF + honeypot network security (CC6.6)
• USDC on-chain payment audit trail (CC6.7)

CC7 System Operations

• L3 + threat intel monitoring (CC7.1)
• Honeypot + WAF incident detection (CC7.2)
• Auto-quarantine incident response (CC7.3)
• Git-based architecture = recovery via git revert (CC7.4)
• L1.7 + L3 change management (CC7.5)

Plus: Availability, Confidentiality, Processing Integrity.

What this unlocks

Enterprise tier pricing: 49.99/month with:

• This SOC 2 mapping as a downloadable compliance artifact
• Self-hosted Sentinel
• Private catalog
• Custom malware signatures
• SLA

1000 enterprise customers x 49.99/month = 600K MRR.

The honest part

This is a self-assessment, not a certified SOC 2 audit. A certified audit requires:

1. Compliance platform (Vanta/Drata): 8K-12K/year
2. Third-party auditor (AICPA firm): 15K-50K
3. 6-12 months of evidence collection

We cant afford that yet (zero revenue). But this self-assessment is more than any other MCP directory has. Most have nothing.

Roadmap to full SOC 2 Type II

1. Self-assessment (this document) DONE
2. Implement gaps Q4 2026
3. Vanta/Drata Q1 2027 (when revenue allows)
4. Third-party audit Q2 2027
5. SOC 2 Type II report Q3 2027

Full mapping: https://github.com/edgarfloresguerra2011-a11y/marketnow/blob/master/docs/SOC2-MAPPING.md

Edison Flores, AliceLabs LLC