Agent Compliance Map
Your AI policy says what agents may do. Show auditors that they did.
Watchlight AI Beacon turns the agent controls in your governance program into enforcement at runtime and evidence you can verify. See it mapped, requirement by requirement, across 10 frameworks, from ISO/IEC 42001 to the EU AI Act.
- ISO/IEC 42001:2023
- NIST AI RMF 1.0
- EU AI Act
- ISO/IEC 27001:2022
- SOC 2
- OWASP Top 10 for Agentic Applications
- MITRE ATLAS
- CSA AI Controls Matrix
- Singapore Agentic AI Framework
- NIST CSF 2.0 and SP 800-53
Where programs stall
Agents act at machine speed. Most governance programs still run on paper.
01
The policy lives in a document.
Your AI policy says what agents may do. Nothing in the run checks it before an agent acts.
02
The log shows what happened, not who allowed it.
Auditors ask which policy permitted an action and on whose authority. Application logs rarely say.
03
Oversight can’t stop a run.
A dashboard alert after the fact doesn’t meet a requirement to intervene, override or halt.
What Beacon adds to your program
Controls that operate, and the proof that they did.
Enforce the policy you wrote
Agent rules become policy that is checked before each governed action runs, at the enforcement points you deploy.
Human oversight you can show
Categories of action wait for an operator’s approval, and any run can be quarantined or stopped mid-flight.
Evidence by default
Every governed decision lands in a signed, hash-chained record naming the policy that decided it and the person behind the agent.
One control set, many frameworks
The same nine runtime capabilities answer requirements in every framework on this page. Build once, map many.
Inventory and accountability
Agents, MCP servers, tools and AI applications in one registry, with approval states and risk ratings.
Test before you enforce
Validate policies and run them in observe mode to see what they would deny before they gate real work.
The map at a glance
One set of runtime controls. 10 frameworks.
Each dot is a Beacon capability the full map uses to answer that framework’s requirements.
| Beacon capability | ISO 42001 | NIST AI RMF | EU AI Act | ISO 27001 | SOC 2 | OWASP Agentic | MITRE ATLAS | CSA AICM | IMDA Agentic | NIST CSF / 800-53 |
|---|---|---|---|---|---|---|---|---|---|---|
| DecidePre-action authorization | ||||||||||
| DecidePlan validation | ||||||||||
| EnforceDelegation narrowing | ||||||||||
| EnforceHuman approval | ||||||||||
| ContainContainment | ||||||||||
| ProveSigned audit trail | ||||||||||
| DecideInventory and risk rating | ||||||||||
| DecidePolicy as code | ||||||||||
| ProveEvidence export |
Certifiable standard
ISO/IEC 42001:2023
- Pre-action authorization
- Plan validation
- Delegation narrowing
- Human approval
- Containment
- Signed audit trail
- Inventory and risk rating
- Policy as code
- Evidence export
Voluntary framework
NIST AI RMF 1.0
- Pre-action authorization
- Delegation narrowing
- Human approval
- Containment
- Signed audit trail
- Inventory and risk rating
- Policy as code
- Evidence export
Regulation
EU AI Act
- Pre-action authorization
- Plan validation
- Delegation narrowing
- Human approval
- Containment
- Signed audit trail
- Policy as code
- Evidence export
Certifiable standard
ISO/IEC 27001:2022
- Pre-action authorization
- Delegation narrowing
- Human approval
- Containment
- Signed audit trail
- Inventory and risk rating
- Policy as code
Attestation
SOC 2
- Pre-action authorization
- Delegation narrowing
- Containment
- Signed audit trail
- Inventory and risk rating
- Policy as code
- Evidence export
Security guidance
OWASP Top 10 for Agentic Applications
- Pre-action authorization
- Plan validation
- Delegation narrowing
- Human approval
- Containment
- Signed audit trail
- Inventory and risk rating
Threat knowledge base
MITRE ATLAS
- Pre-action authorization
- Plan validation
- Delegation narrowing
- Human approval
- Containment
- Signed audit trail
- Evidence export
Control framework
CSA AI Controls Matrix
- Pre-action authorization
- Delegation narrowing
- Human approval
- Containment
- Signed audit trail
- Policy as code
- Evidence export
Voluntary framework
Singapore Agentic AI Framework
- Pre-action authorization
- Plan validation
- Delegation narrowing
- Human approval
- Containment
- Signed audit trail
Control framework
NIST CSF 2.0 and SP 800-53
- Pre-action authorization
- Delegation narrowing
- Containment
- Signed audit trail
A look inside
Requirement, how Beacon helps, and the evidence it leaves.
Certifiable standard ISO/IEC
ISO/IEC 42001:2023
AI management system
The certifiable standard for an AI management system. Auditors look for AI controls that operate in production and records that show it.
- Enforces
- Beacon enforces the control at runtime where enforcement points are deployed.
- Evidence
- Beacon produces records an auditor can use as evidence for the control.
- Supports
- Beacon covers part of the control. Your program owns the rest.
A.6.2.6
AI system operation and monitoring
Operate AI systems as intended and monitor them in production.
How Beacon helps
Each governed action is checked against policy before it runs, and runs that drift from their plan or baseline are contained while still active.
- Pre-action authorization
- Containment
EnforcesEvidence
Decision records naming the policy that decided each action; drift and quarantine events.
A.6.2.8
AI system recording of event logs
Record event logs while the AI system is in use.
How Beacon helps
Every governed decision and containment action is written to an append-only, hash-chained, signed audit trail in your environment.
- Signed audit trail
- Evidence export
EvidenceEvidence
Signed records with a chain you can verify on demand; API query and export.
A.9.4
Intended use of the AI system
Use the AI system according to its intended use.
How Beacon helps
Actions are weighed against the task the agent was given and the intent categories it is allowed. Off-task actions are denied before they run.
- Pre-action authorization
- Plan validation
EnforcesEvidence
Denials with the reason and the task context at the time.
77 requirements across 10 frameworks
The rest of ISO/IEC 42001, and every other framework, in the full map.
Unlock the full mapGet the full map
Take it to your next audit, steering committee, or architecture review.
- 77 requirements across 10 frameworks, each with the control ID and title from the primary source.
- How Beacon helps with each one, and whether it enforces the control, produces evidence, or supports it.
- The evidence each control leaves behind, so you know what to hand an auditor.
- What stays with your program, so the map never overstates what a tool can do.
The map shows how Watchlight AI Beacon supports controls in each framework. It isn’t legal advice or a certification; your auditor and counsel decide conformity. Framework names and control IDs belong to their publishers. Enforcement applies where Beacon’s enforcement points are deployed.