A Relay that chases audit evidence so your team does not have to

A SOC 2 examination or an ISO 27001 audit produces a long request list: access reviews, change tickets, restore tests, training records, vendor reviews. Collecting the evidence is rarely hard. Keeping track of who owes what, by when, and whether it matches what the auditor asked for takes most of the effort.

That tracking work suits a Relay, an AI coworker in Agent Serve with its own instructions, schedule and approvals. It can watch the tracker, notice what is late or incomplete, and draft the follow-ups. People still own the evidence, the reminders that go out and everything shared with the auditor.

A note before starting: this playbook is about your audit. Agent Serve itself does not hold a SOC 2 report or an ISO 27001 certificate. Its security page describes the controls in place as SOC 2 and GDPR ready, which is not a certification.

Put the request list in one table

Start with the auditor’s request list, usually a spreadsheet. Import it into a workspace table with one row per request and these columns at minimum: request ID, control, description, owner, due date, status and evidence link.

Keep the status values short and fixed, such as open, submitted, accepted and returned. The Relay reads them, and fixed values make "what is late" a precise question.

The Relay can query this table but cannot write to it. Control owners and the audit lead keep it current, which means the record of who submitted what stays with people.

Give the Relay the context an auditor expects

A reminder that says "please send evidence for logical access" gets a screenshot of the wrong thing. A reminder that says what the auditor accepted last year gets the right thing first time.

Upload your control descriptions, the auditor’s guidance notes and last year’s accepted evidence list to a Knowledge Base. Connect it to the Relay. When it drafts a reminder, it searches for the control and describes what good evidence looks like in plain words.

Write instructions that set the limits

Relay instructions are plain text, up to 8,000 characters. Be specific about the job and its limits. For example:

• The job. Track the evidence tracker, draft reminders for requests due within five days or overdue, and write a weekly status.
• The limits. Never contact the auditor. Never mark a request accepted. Only email people inside the company.
• The tone. Short, polite, one request per message, with the request ID in the subject.

Set the email recipient policy to internal only, so a reminder to an outside address cannot even be proposed.

Choose the autonomy level

Each Relay runs at one of three autonomy levels. For audit work, Assist is a good default.

• Observe lets the Relay read and draft, but blocks saving files and sending email. Useful for the first week, while you check its judgement.
• Assist lets it save files to the library and send email, each only after an approval.
• Operate lets it save files without approval. Email still needs one, at every level.

Approvals are tied to the exact text the reviewer saw. If anyone edits the reminder, it needs a fresh approval. Unanswered approvals expire after 24 hours by default, and a Relay can name up to 20 approvers.

Set up the watch and the weekly schedule

Two responsibilities cover most audit work:

1. A watch on the tracker table. Describe what needs attention in plain language, for example "requests due within five days that are still open, or any request marked returned". Set it to poll every 60 minutes, with quiet hours overnight. Watches never write to the source.
2. A weekly schedule. A cron schedule on Monday at 08:00 runs the status job and saves the file to the library folder your audit lead shares.

Each result is reported back into the audit lead’s chat with the Relay and raises a notification.

Review what it produces