Agentic Trust Controls (ATC) assessment
Agentic Trust Controls is an open set of 65 controls for AI agents, published by Vanta. It has a Developer baseline for teams that build agents and a User baseline for teams that deploy them. VeriProof saves an assessment for all 65, so you can see what an application recorded and what your organization still needs to show.
A saved assessment is not a certification. Your organization decides whether each control is met, using VeriProof’s records and its own evidence.
What VeriProof records
VeriProof evidences its part of 24 controls from records it already keeps. They appear first in every control list.
| Area | Controls | Recorded application facts |
|---|---|---|
| Pre-execution enforcement | TUE-01, TUE-03, TUE-06, HOA-02, HOA-03, RBM-04, RBM-06 | Decisions made outside the agent before an action ran, with the rule version and outcome |
| Human oversight | HOA-01 to HOA-06 | Review cases bound to the protected action, its policy evaluation, and the decision version, plus expiry that never resumes the action |
| Authority and delegation | AID-05, MAS-03, MAS-04 | Attributed actors, decision records, and checks made before one agent called another |
| Tamper-evident records | RBM-01, RBM-03, RBM-04, RBM-05 | Verified activity records, archive integrity, model and tool channels, and monitoring rule checks |
| Inventory and scope | AID-06, MEM-04, TUE-08, GOV-01, GOV-03 | Declared tasks, data classifications, role grants, and approval gates |
| Change and assurance | SCP-06, ADV-03 | Model, prompt, and rule changes with linked retests, and verified experiment runs |
Each control still has an organization requirement, such as your autonomy tiering matrix or owner register. Recorded facts never decide a control on their own.
Organization-evidenced controls
The other 41 controls cover the agent’s own design, such as memory and prompt-injection defenses, or your organization’s processes, such as training and vendor review. VeriProof doesn’t record evidence for them. They appear in a collapsed Organization-evidenced controls section and never lower VeriProof’s evidence score.
Review a saved assessment
Activate ATC for the application
Open the application, select Compliance, then turn on Agentic Trust Controls.
Select the assessment period
Choose the dates to review. The assessment uses activity and decisions recorded in that period.
Review the controls with VeriProof evidence
Each control lists its recorded facts, what is missing, and the next step. Open Organization-evidenced controls to see the rest.
Send the evidence to Vanta
From Settings → Integrations → Vanta, send the Agentic Trust Controls evidence summary to a Vanta document. Each control’s next step names the matching Vanta ATC document request, such as Human-approval workflows for HOA-06.
Vanta document requests
Vanta collects ATC evidence through document requests. The assessment names the request for every control, for example:
| Control | Vanta document request |
|---|---|
| TUE-01 Deterministic tool guardrails | Execution-level safeguards |
| HOA-06 Approval-to-action binding | Human-approval workflows |
| RBM-03 Tamper-evident action logging | Agents Unable to Modify or Delete Backups, Snapshots, and Action Logs |
| GOV-03 Accountability ownership per agent | Agent Ownership and Accountability Register |