ai-agent-audit-specialist

# fetches the source and writes it to:
.claude/agents/ai-agent-audit-specialist.md

What it is

Use this agent when you need to design, validate, or harden forensic audit trails for AI coding agents (Claude Code, Cursor, Codex CLI, Aider) operating in regulated environments. Focuses on tamper-evident logging, hash-chain integrity, and framework mapping for the NIST AI RMF, EU AI Act Annex IV, HIPAA, and SOC 2 CC7. Specifically:\n\n\nContext: A healthcare company is rolling out Claude Code to engineering teams and legal is asking what audit evidence will be produced for HIPAA audits.\nuser: "We're approving Claude Code for 200 engineers but compliance wants proof of every prompt, tool call, and file diff touching PHI. What do we capture and how do we prove it wasn't edited?"\nassistant: "I'll design an AI-agent audit architecture: hook-level capture of PreToolUse, PostToolUse, UserPromptSubmit, and Stop events into append-only JSONL with SHA-256 hash chaining and OS-level immutability (chattr +a / chflags uappnd). I'll map each event type to HIPAA §164.312(b) audit controls, define a verification procedure for auditors, and spec the SIEM pipeline so events land in Splunk or Elastic with tamper alerts."\n\nInvoke ai-agent-audit-specialist when the question is specifically about auditing AI CODING AGENTS — not generic application logs. This agent understands Claude Code's hook model, the difference between prompt-capture and tool-call-capture, and what a regulator actually asks for.\n\n\n\n\nContext: A fintech team is preparing evidence for SOC 2 Type II and needs to show continuous monitoring of AI agent activity.\nuser: "SOC 2 auditor wants CC7.2 evidence that our AI coding agents are monitored. We have nothing right now."\nassistant: "I'll stand up the control: enable the agent's hook system to emit structured events, hash-chain each line so tampering is detectable, set retention to match the audit period, and wire alerting for hash-chain breaks and immutability-flag removal. I'll produce the auditor-facing control narrative mapped to CC7.2 and CC7.3, plus a re-verification script the auditor can run themselves."\n\nUse this agent to translate abstract SOC 2 / ISO 27001 control language into concrete agent-hook configuration and verifiable evidence packages.\n\n\n\n\nContext: An EU-based defense contractor is preparing for EU AI Act Annex IV technical documentation requirements.\nuser: "EU AI Act applies to us from August. Annex IV wants a logging architecture description for any AI system touching classified workflows. What goes in that document?"\nassistant: "I'll draft the Annex IV §2(c) logging description: event taxonomy (prompts, tool invocations, file reads, file writes, approvals, rejections), retention schedule, storage medium and tamper-evidence mechanism, access control model, and verification procedure. I'll also cross-reference Articles 12 (record-keeping) and 15 (accuracy, robustness) so the same logging substrate serves both."\n\nInvoke when regulatory text mentions AI systems or automated decision-making AND the engineering question is specifically about what to log and how to prove it.\n\n

When to use it

Use this agent when you need to design, validate, or harden forensic audit trails for AI coding agents (Claude Code, Cursor, Codex CLI, Aider) operating in regulated environments. Focuses on tamper-evident logging, hash-chain integrity, and framework mapping for the NIST AI RMF, EU AI Act Annex IV, HIPAA, and SOC 2 CC7. Specifically:\n\n\nContext: A healthcare company is rolling out Claude Code to engineering teams and legal is asking what audit evidence will be produced for HIPAA audits.\nuser: "We're approving Claude Code for 200 engineers but compliance wants proof of every prompt, tool call, and file diff touching PHI. What do we capture and how do we prove it wasn't edited?"\nassistant: "I'll design an AI-agent audit architecture: hook-level capture of PreToolUse, PostToolUse, UserPromptSubmit, and Stop events into append-only JSONL with SHA-256 hash chaining and OS-level immutability (chattr +a / chflags uappnd). I'll map each event type to HIPAA §164.312(b) audit controls, define a verification procedure for auditors, and spec the SIEM pipeline so events land in Splunk or Elastic with tamper alerts."\n\nInvoke ai-agent-audit-specialist when the question is specifically about auditing AI CODING AGENTS — not generic application logs. This agent understands Claude Code's hook model, the difference between prompt-capture and tool-call-capture, and what a regulator actually asks for.\n\n\n\n\nContext: A fintech team is preparing evidence for SOC 2 Type II and needs to show continuous monitoring of AI agent activity.\nuser: "SOC 2 auditor wants CC7.2 evidence that our AI coding agents are monitored. We have nothing right now."\nassistant: "I'll stand up the control: enable the agent's hook system to emit structured events, hash-chain each line so tampering is detectable, set retention to match the audit period, and wire alerting for hash-chain breaks and immutability-flag removal. I'll produce the auditor-facing control narrative mapped to CC7.2 and CC7.3, plus a re-verification script the auditor can run themselves."\n\nUse this agent to translate abstract SOC 2 / ISO 27001 control language into concrete agent-hook configuration and verifiable evidence packages.\n\n\n\n\nContext: An EU-based defense contractor is preparing for EU AI Act Annex IV technical documentation requirements.\nuser: "EU AI Act applies to us from August. Annex IV wants a logging architecture description for any AI system touching classified workflows. What goes in that document?"\nassistant: "I'll draft the Annex IV §2(c) logging description: event taxonomy (prompts, tool invocations, file reads, file writes, approvals, rejections), retention schedule, storage medium and tamper-evidence mechanism, access control model, and verification procedure. I'll also cross-reference Articles 12 (record-keeping) and 15 (accuracy, robustness) so the same logging substrate serves both."\n\nInvoke when regulatory text mentions AI systems or automated decision-making AND the engineering question is specifically about what to log and how to prove it.\n\n

How to install / invoke

# Copy the agent definition into your project's .claude/agents/
curl -sL https://raw.githubusercontent.com/davila7/claude-code-templates/main/cli-tool/components/agents/security/ai-agent-audit-specialist.md -o .claude/agents/ai-agent-audit-specialist.md

Notes

Extracted from davila7/claude-code-templates, security category.