Standards, Agentic Trust Controls
Evidence for the Agentic Trust Controls, ready for Vanta
VeriProof keeps records that support 24 of the 65 Agentic Trust Controls, Vanta's open-source control set for AI agents, and sends the summary to the Vanta document you pick.
About the control set
Agentic Trust Controls is an open-source project powered by Vanta, with outside contributors, published at trustcontrols.ai. It extends the security frameworks you already use with controls written for agents. The 65 controls are grouped into 12 domains, from agent identity and tool use to memory integrity and runaway cost. A Developer baseline of 43 controls applies to teams that build agents, and a User baseline of 22 applies to teams that deploy them.
Vanta collects ATC evidence through document requests, so each control already has a named place in your Vanta account where its evidence belongs.
The 24 controls VeriProof records evidence for
| Type of record | Controls | What VeriProof records |
|---|---|---|
| Checks before an action runs | TUE‑01, TUE‑03, TUE‑06, HOA‑02, HOA‑03, RBM‑04, RBM‑06 | Each decision VeriProof made before an action ran, with the rule and the result |
| Human oversight | HOA‑01 to HOA‑06 | Review cases tied to the protected action, its policy evaluation, and the decision version. An expired review never resumes the action. |
| Who acted, and for whom | AID‑05, MAS‑03, MAS‑04 | Who took each action, the decision behind it, and the checks made before one agent handed work to another |
| Records that show any change | RBM‑01, RBM‑03, RBM‑04, RBM‑05 | Activity records that can be checked for changes, protected archives, and the monitoring rules applied to each agent |
| What each agent may do | AID‑06, MEM‑04, TUE‑08, GOV‑01, GOV‑03 | The tasks, data types, permissions, and approval steps set for each agent |
| Changes and testing | SCP‑06, ADV‑03 | Changes to models, prompts, and rules, each linked to the tests run afterward |
Some controls appear in two areas because more than one kind of record supports them.
What your organization provides
The other 41 controls cover how the agent itself is built, such as memory and prompt-injection defenses, or your own processes, such as training and vendor review. VeriProof doesn't record evidence for them. They sit in a collapsed section of the assessment and never lower VeriProof's evidence score.
Each control also asks for something from your organization, such as an autonomy tiering matrix or an owner register. The assessment lists it next to VeriProof's records, so your team sees the whole control in one view.
From assessment to Vanta
Turn on ATC for the application
In the application's Compliance tab, turn on Agentic Trust Controls.
Pick the period
The assessment uses the decisions and activity recorded between the dates you choose.
Review the controls
Each control lists its recorded facts, what's missing, and the next step. Controls with VeriProof evidence come first.
Send the summary to Vanta
Send the Agentic Trust Controls evidence summary to a Vanta document. Each control's next step names the matching Vanta document request, such as Human-approval workflows for HOA-06.
The ATC guide lists the Vanta document request for every control.