# Managing Audit and Compliance Reports

SailPoint Agent Fabric auditing and compliance reporting provides auditor-ready records for agent inventory, ownership, monitoring, and governance evidence. Admins can generate framework-aligned reports on a scheduled or ad hoc basis, so compliance teams can show governance posture on demand.

Audit and compliance reporting provides:

- **Identity records** - Visibility of who owns the agent and what access it has.

- **Action audit trail** - Visibility of what the agent did and when.

- **Compliance evidence packaging** - Identity governance and action audit trail, packaged into formats external auditors and regulators can consume.

!!! note

Agent Audit organizes evidence from your SailPoint environment to support your compliance and governance efforts. Evidence reports provided by SailPoint reflect only the data available in SailPoint's platform and may constitute one part of an overall compliance package. Each report should be reviewed and supplemented by your compliance, legal, or audit teams to confirm sufficiency for a given framework.

## Managing Frameworks

Generate reports based upon common frameworks, or create custom frameworks according to your organization's compliance requirements.

Select the **Status** dropdown to filter frameworks by status:

- **Complete** - Evidence collection is complete.

- **In Progress** - Evidence collection is in progress.

- **Partial** - Evidence collection is partially complete due to unavailability of some reports.

- **Not Started** - No evidence reports are currently available.

Exporting a framework generates all evidence reports associated with the framework.

### Exporting Frameworks

Generate framework-aligned reports in formats external auditors and regulators can consume.

1. Go to **Agentic Fabric**.

2. Select **Audit and Compliance** from the left pane.

3. Select the **Frameworks** tab.

4. Find the framework you want to export and select **Export**.

Exported frameworks are available to view and download on the **Export History** page. Refer to [Viewing Export History](#viewing-export-history) for more information.

### Creating Custom Frameworks

Create a custom framework that complies with your organization's compliance requirements.

1. Go to **Agentic Fabric**.

2. Select **Audit and Compliance** from the left pane.

3. Select the **Frameworks** tab.

4. Select **Create Framework**.

5. In the **Framework Name** field, enter a name to identify the custom framework.

6. In the **Description** field, enter a description detailing what the framework is for.

7. In the **Framework Selection** field, select the frameworks to include.

8. In the **Evidence Reports** field, select the evidence reports to include.

9. Select **Create Framework**.

The framework is available for export from the **Frameworks** tab.

### Deleting Frameworks

1. Go to **Agentic Fabric**.
2. Select **Audit and Compliance** from the left pane.
3. Select the **Frameworks** tab.
4. Find the framework you want to delete and select **Delete**.
5. Confirm the deletion.

## Managing Evidence Reports

Evidence reports include agent, identity, and action audit trail details including:

- Discovery events, governance decisions, and behavioral detections.

- Who approved AI agent access rights.

- Which AI agents process personal data, and where the record of processing activity is located.

Select the **Category** dropdown to filter by report category or search for reports by report name.

| Evidence Report | Categories | Scope |
| --- | --- | --- |
| Agent Account and Capability | Inventory | Enumeration of connected resources per discovered agent, including MCP servers, tools, skills, and accounts, with resource identifiers, resource names, owner, and discovery timestamp. |
| Agent Identity Discovery | Inventory | Inventory of discovered AI agents with type, description, business application, native identity, discovery source, owner, risk classification, and connected MCP servers, tools, and skills. |
| Agent Ownership Change Tracking | Ownership | Record of ownership change events for AI agents, including previous and new owner, update reason, actor, and effective date. |
| Application Identity Inventory | Inventory | Registry of application identities with descriptions, modification timestamps, and owner assignments. |
| Credential Discovery | Credential | Inventory of credentials (tokens, keys, service account credentials, secrets) discovered across AI agents and machine identities, including credential type, associated identity, source system, and creation date. |
| Credential Lifecycle | Credential | Lifecycle record of credentials including creation date, last rotation date, expiration status, last used date, and correlated identity and source system. |
| Endpoints Report | Inventory | Inventory of endpoints where AI agents operate, including device names, OS type and version, and discovery sources. |
| Machine Account Ownership Change Tracking | Ownership | Record of ownership change events for machine accounts and service accounts, including previous and new owner, change reason, actor, and event timestamp. |
| MCP Server Discovery | Inventory | Registry of MCP servers discovered, including server name, agent binding relationships, owner attribution, and discovery timestamps. |
| NHI Change History | Logging | Append-only change history for non-human identities (agents, applications), capturing audit events with identity attributes, discovery source, actor attribution, and timestamps. |
| NHI Permissions Inventory | Inventory | Permissions inventory for non-human identities, including individual entitlements per credential, privilege level classification, and source attribution. |
| Non-Human Identity Inventory | Inventory | Inventory of all machine accounts (service accounts, service principals, IAM roles) with native identities, sub-type classification, ownership, source and connector attribution, and creation/modification timestamps. |
| Periodic Access Review Campaigns (Machine Account) | Access Review | Record of access certification campaigns for machine accounts, including evidence of entitlement reviews, reviewer decisions, and campaign completion status. |
| Periodic Access Review Campaigns (Source Entitlements) | Access Review | Record of access certification campaigns for entitlements associated with a non-human identity source, including evidence of entitlement reviews, reviewer decisions, and campaign completion status. |
| Policy Configuration and Governance | Policy | Registry of policy rules, including policy type, configuration criteria, enabled status, owner, and last modified timestamp. |
| Prompt Security Detection | Policy | Detection log from the prompt security engine, including sensitive data detections (PII, credentials), severity classification, enforcement action, agent attribution, and detection source. |
| Risk Score and Attribution | Risk | The system computes a risk score for every discovered agent, attributes each score change to a specific triggering event, and provides a transparent factor breakdown showing the weight and contribution of each risk signal. |
| Tools Report | Inventory | Inventory of all tools available to AI agents with native identity references, modification timestamps, source systems, and connector source. |

### Previewing Evidence Reports

Preview evidence reports to view their contents before generating them.

1. Go to **Agentic Fabric**.
2. Select **Audit and Compliance** from the left pane.
3. Select the **Evidence Reports** tab.
4. Find the evidence report you want to preview and select **Preview**.

A preview of the report is displayed.

### Exporting Evidence Reports

Generate evidence reports in formats external auditors and regulators can consume.

1. Go to **Agentic Fabric**.
2. Select **Audit and Compliance** from the left pane.
3. Select the **Evidence Reports** tab.
4. Find the evidence report you want to export and select **Export**. A .zip file is generated and downloaded to your device.

Exported evidence reports are also available to view and download on the [Export History](#viewing-export-history) page.

**To export all evidence reports:**

1. Go to **Agentic Fabric**.

2. Select **Audit and Compliance**. from the left pane.

3. Select the **Evidence Reports** tab.

4. Select **Export All** to generate and download a zip file of all reports to your workstation.

Exported evidence reports are also available to view and download on the [Export History](#viewing-export-history) page.

## Viewing Export History

The Export History page lists all previously exported frameworks and evidence reports. You can filter the results by report name, status, and schedule.

Report statuses include:

- **Available** - Available for download.

- **In Progress** - Currently being generated.

- **Failed** - Failed during generation or download.

### Downloading Exports

To view your exports, download exported frameworks and evidence reports from the Export History page.

1. Go to **Agentic Fabric**.
2. Select **Audit and Compliance** from the left pane.
3. Select the **Export History** tab.
4. Find the evidence report or framework you want to download and select **Actions** ![](img/actions-menu.png#icon) **> Download**.

The file is downloaded to your device.

### Deleting Exports

You can delete exported frameworks and evidence reports from the Export History page.

1. Go to **Agentic Fabric**.
2. Select **Audit and Compliance** from the left pane.
3. Select the **Export History** tab.
4. Find the evidence report or framework you want to delete and select **Actions** ![](img/actions-menu.png#icon) **> Delete**.
5. Select **Delete Report** to confirm the deletion.

## Managing Export Schedules

Schedule the automatic generation of exports for frameworks and evidence reports on a daily, weekly, monthly, quarterly, or semi-annual basis.

### Creating Export Schedules

1. Go to **Agentic Fabric**.
2. Select **Audit and Compliance** from the left pane.
3. Select the **Export Schedule** tab.
4. In the **Schedule Name** field, enter a name for the export schedule.
5. In the **Frequency** field, select the desired frequency.

- If you select **Daily**, complete the following fields:

- **Time of Day** - Select the time of day the export schedule will run.

- **Start Date** - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.

- **Expiration Date** - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.

- **Frameworks** - Select the frameworks that will be generated by the export schedule. You can make multiple selections.

- **Reports** - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.

The export schedule will first run on the configured start date and time of day, and it will continue to run at the scheduled time each day until the expiration date is reached.

- If you select **Weekly**, complete the following fields:

- **Day of Week** - Select the day of the week the export schedule will run.

- **Time of Day** - Select the time of day the export schedule will run.

- **Start Date** - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.

- **Expiration Date** - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.

- **Frameworks** - Select the frameworks that will be generated by the export schedule. You can make multiple selections.

- **Reports** - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.

The export schedule will first run on the configured start date and time of day, and it will continue to run on that day and time each week until the expiration date is reached.

- If you select **Monthly**, complete the following fields:

- **Day of Month** - Select the day of the month the export schedule will run.

- **Time of Day** - Select the time of day the export schedule will run.

- **Start Date** - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.

- **Expiration Date** - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.

- **Frameworks** - Select the frameworks that will be generated by the export schedule. You can make multiple selections.

- **Reports** - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.

The export schedule will first run on the configured start date and time of day, and it will continue to run on that date and time each month until the expiration date is reached.

- If you select **Quarterly**, complete the following fields:

- **Time of Day** - Select the time of day the export schedule will run.

- **Start Date** - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.

- **Expiration Date** - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.

- **Frameworks** - Select the frameworks that will be generated by the export schedule. You can make multiple selections.

- **Reports** - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.

The export schedule will first run on the configured start date and time of day, and it will continue to run on the same day of the month and time every 3 months until the expiration date is reached.

- If you select **Semi-Annually**, complete the following fields:

- **Time of Day** - Select the time of day the export schedule will run.

- **Start Date** - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.

- **Expiration Date** - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.

- **Frameworks** - Select the frameworks that will be generated by the export schedule. You can make multiple selections.

- **Reports** - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.

The export schedule will first run on the configured start date and time of day, and it will continue to run on the same day of the month and time every 6 months until the expiration date is reached.

6. Select **Save Schedule**.

The export schedule card is displayed, detailing its configuration.

### Updating Export Schedules

1. Go to **Agentic Fabric**.
2. Select **Audit and Compliance** from the left pane.
3. Select the **Export Schedule** tab.
4. Select **Edit** on the export schedule card you want to edit.
5. Apply the required changes.
6. Select **Update Schedule**.

### Deleting Export Schedules

1. Go to **Agentic Fabric**.
2. Select **Audit and Compliance** from the left pane.
3. Select the **Export Schedule** tab.
4. Select **Delete** on the export schedule card you want to delete.
5. Select **Delete** to confirm the deletion.

Managing Audit and Compliance Reports

SailPoint Agent Fabric auditing and compliance reporting provides auditor-ready records for agent inventory, ownership, monitoring, and governance evidence. Admins can generate framework-aligned reports on a scheduled or ad hoc basis, so compliance teams can show governance posture on demand.

Audit and compliance reporting provides:

Identity records - Visibility of who owns the agent and what access it has.
Action audit trail - Visibility of what the agent did and when.
Compliance evidence packaging - Identity governance and action audit trail, packaged into formats external auditors and regulators can consume.

Note

Agent Audit organizes evidence from your SailPoint environment to support your compliance and governance efforts. Evidence reports provided by SailPoint reflect only the data available in SailPoint's platform and may constitute one part of an overall compliance package. Each report should be reviewed and supplemented by your compliance, legal, or audit teams to confirm sufficiency for a given framework.

Managing Frameworks

Generate reports based upon common frameworks, or create custom frameworks according to your organization's compliance requirements.

Select the Status dropdown to filter frameworks by status:

Complete - Evidence collection is complete.
In Progress - Evidence collection is in progress.
Partial - Evidence collection is partially complete due to unavailability of some reports.
Not Started - No evidence reports are currently available.

Exporting a framework generates all evidence reports associated with the framework.

Exporting Frameworks

Generate framework-aligned reports in formats external auditors and regulators can consume.

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Frameworks tab.
Find the framework you want to export and select Export.

Exported frameworks are available to view and download on the Export History page. Refer to Viewing Export History for more information.

Creating Custom Frameworks

Create a custom framework that complies with your organization's compliance requirements.

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Frameworks tab.
Select Create Framework.
In the Framework Name field, enter a name to identify the custom framework.
In the Description field, enter a description detailing what the framework is for.
In the Framework Selection field, select the frameworks to include.
In the Evidence Reports field, select the evidence reports to include.
Select Create Framework.

The framework is available for export from the Frameworks tab.

Deleting Frameworks

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Frameworks tab.
Find the framework you want to delete and select Delete.
Confirm the deletion.

Managing Evidence Reports

Evidence reports include agent, identity, and action audit trail details including:

Discovery events, governance decisions, and behavioral detections.
Who approved AI agent access rights.
Which AI agents process personal data, and where the record of processing activity is located.

Select the Category dropdown to filter by report category or search for reports by report name.

Evidence Report	Categories	Scope
Agent Account and Capability	Inventory	Enumeration of connected resources per discovered agent, including MCP servers, tools, skills, and accounts, with resource identifiers, resource names, owner, and discovery timestamp.
Agent Identity Discovery	Inventory	Inventory of discovered AI agents with type, description, business application, native identity, discovery source, owner, risk classification, and connected MCP servers, tools, and skills.
Agent Ownership Change Tracking	Ownership	Record of ownership change events for AI agents, including previous and new owner, update reason, actor, and effective date.
Application Identity Inventory	Inventory	Registry of application identities with descriptions, modification timestamps, and owner assignments.
Credential Discovery	Credential	Inventory of credentials (tokens, keys, service account credentials, secrets) discovered across AI agents and machine identities, including credential type, associated identity, source system, and creation date.
Credential Lifecycle	Credential	Lifecycle record of credentials including creation date, last rotation date, expiration status, last used date, and correlated identity and source system.
Endpoints Report	Inventory	Inventory of endpoints where AI agents operate, including device names, OS type and version, and discovery sources.
Machine Account Ownership Change Tracking	Ownership	Record of ownership change events for machine accounts and service accounts, including previous and new owner, change reason, actor, and event timestamp.
MCP Server Discovery	Inventory	Registry of MCP servers discovered, including server name, agent binding relationships, owner attribution, and discovery timestamps.
NHI Change History	Logging	Append-only change history for non-human identities (agents, applications), capturing audit events with identity attributes, discovery source, actor attribution, and timestamps.
NHI Permissions Inventory	Inventory	Permissions inventory for non-human identities, including individual entitlements per credential, privilege level classification, and source attribution.
Non-Human Identity Inventory	Inventory	Inventory of all machine accounts (service accounts, service principals, IAM roles) with native identities, sub-type classification, ownership, source and connector attribution, and creation/modification timestamps.
Periodic Access Review Campaigns (Machine Account)	Access Review	Record of access certification campaigns for machine accounts, including evidence of entitlement reviews, reviewer decisions, and campaign completion status.
Periodic Access Review Campaigns (Source Entitlements)	Access Review	Record of access certification campaigns for entitlements associated with a non-human identity source, including evidence of entitlement reviews, reviewer decisions, and campaign completion status.
Policy Configuration and Governance	Policy	Registry of policy rules, including policy type, configuration criteria, enabled status, owner, and last modified timestamp.
Prompt Security Detection	Policy	Detection log from the prompt security engine, including sensitive data detections (PII, credentials), severity classification, enforcement action, agent attribution, and detection source.
Risk Score and Attribution	Risk	The system computes a risk score for every discovered agent, attributes each score change to a specific triggering event, and provides a transparent factor breakdown showing the weight and contribution of each risk signal.
Tools Report	Inventory	Inventory of all tools available to AI agents with native identity references, modification timestamps, source systems, and connector source.

Previewing Evidence Reports

Preview evidence reports to view their contents before generating them.

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Evidence Reports tab.
Find the evidence report you want to preview and select Preview.

A preview of the report is displayed.

Exporting Evidence Reports

Generate evidence reports in formats external auditors and regulators can consume.

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Evidence Reports tab.
Find the evidence report you want to export and select Export. A .zip file is generated and downloaded to your device.

Exported evidence reports are also available to view and download on the Export History page.

To export all evidence reports:

Go to Agentic Fabric.
Select Audit and Compliance. from the left pane.
Select the Evidence Reports tab.
Select Export All to generate and download a zip file of all reports to your workstation.

Exported evidence reports are also available to view and download on the Export History page.

Viewing Export History

The Export History page lists all previously exported frameworks and evidence reports. You can filter the results by report name, status, and schedule.

Report statuses include:

Available - Available for download.
In Progress - Currently being generated.
Failed - Failed during generation or download.

Downloading Exports

To view your exports, download exported frameworks and evidence reports from the Export History page.

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Export History tab.
Find the evidence report or framework you want to download and select Actions > Download.

The file is downloaded to your device.

Deleting Exports

You can delete exported frameworks and evidence reports from the Export History page.

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Export History tab.
Find the evidence report or framework you want to delete and select Actions > Delete.
Select Delete Report to confirm the deletion.

Managing Export Schedules

Schedule the automatic generation of exports for frameworks and evidence reports on a daily, weekly, monthly, quarterly, or semi-annual basis.

Creating Export Schedules

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Export Schedule tab.
In the Schedule Name field, enter a name for the export schedule.
In the Frequency field, select the desired frequency.
- If you select Daily, complete the following fields:
  - Time of Day - Select the time of day the export schedule will run.
  - Start Date - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.
  - Expiration Date - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.
  - Frameworks - Select the frameworks that will be generated by the export schedule. You can make multiple selections.
  - Reports - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.
  The export schedule will first run on the configured start date and time of day, and it will continue to run at the scheduled time each day until the expiration date is reached.
- If you select Weekly, complete the following fields:
  - Day of Week - Select the day of the week the export schedule will run.
  - Time of Day - Select the time of day the export schedule will run.
  - Start Date - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.
  - Expiration Date - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.
  - Frameworks - Select the frameworks that will be generated by the export schedule. You can make multiple selections.
  - Reports - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.
  The export schedule will first run on the configured start date and time of day, and it will continue to run on that day and time each week until the expiration date is reached.
- If you select Monthly, complete the following fields:
  - Day of Month - Select the day of the month the export schedule will run.
  - Time of Day - Select the time of day the export schedule will run.
  - Start Date - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.
  - Expiration Date - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.
  - Frameworks - Select the frameworks that will be generated by the export schedule. You can make multiple selections.
  - Reports - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.
  The export schedule will first run on the configured start date and time of day, and it will continue to run on that date and time each month until the expiration date is reached.
- If you select Quarterly, complete the following fields:
  - Time of Day - Select the time of day the export schedule will run.
  - Start Date - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.
  - Expiration Date - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.
  - Frameworks - Select the frameworks that will be generated by the export schedule. You can make multiple selections.
  - Reports - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.
  The export schedule will first run on the configured start date and time of day, and it will continue to run on the same day of the month and time every 3 months until the expiration date is reached.
- If you select Semi-Annually, complete the following fields:
  - Time of Day - Select the time of day the export schedule will run.
  - Start Date - Select or enter the date the export schedule will first run in the MM/DD/YYYY format.
  - Expiration Date - Select or enter the date the export schedule will no longer run in the MM/DD/YYYY format.
  - Frameworks - Select the frameworks that will be generated by the export schedule. You can make multiple selections.
  - Reports - Select the evidence reports that will be generated by the export schedule. You can make multiple selections.
  The export schedule will first run on the configured start date and time of day, and it will continue to run on the same day of the month and time every 6 months until the expiration date is reached.
Select Save Schedule.

The export schedule card is displayed, detailing its configuration.

Updating Export Schedules

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Export Schedule tab.
Select Edit on the export schedule card you want to edit.
Apply the required changes.
Select Update Schedule.

Deleting Export Schedules

Go to Agentic Fabric.
Select Audit and Compliance from the left pane.
Select the Export Schedule tab.
Select Delete on the export schedule card you want to delete.
Select Delete to confirm the deletion.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.