SOC 2：AI-FW 控制与组织责任
了解框架义务、AI-FW 技术控制和组织责任。
SOC 2：AI-FW 控制与组织责任 · 自愿框架
本页说明框架与 AI-FW 的关系。产品支持部分运行时控制，但不替代组织的合规或审计责任。
AI-FW 的定位
- 说明：Depending on configuration, AI-FW records authentication, decisions, changes and model traffic observed by the gateway. It does not produce an SOC 2 report.
产品不负责的事项
- 说明：Defining SOC 2 scope or system description.
- 说明：Operating organisational controls outside gateway.
- 说明：Guaranteeing Type I or Type II.
- 说明：Proving period-long effectiveness alone.
- 说明：Replacing independent CPA examination.
控制映射
- 说明：Logical access: 说明：Restrict access and manage credentials. AI-FW: 说明：Authentication, roles and revocable keys/certificates.
- 说明：Change management: 说明：Authorise and record changes. AI-FW: 说明：Audit Events for rules and configuration.
- 说明：Monitoring: 说明：Detect activity and maintain records. AI-FW: 说明：Transactions, Activity views, risk signals and export.
- 说明：Processing: 说明：Process according to commitments. AI-FW: 说明：Guardrails and model/destination policies.
证据预期
- 说明：Identity: 说明：Modes, roles and authenticated calls.
- 说明：Policy changes: 说明：Actor and time.
- 说明：Activity: 说明：Transactions and risk signals.
组织责任
- 说明：Define service scope and criteria.
- 说明：Operate organisational controls and oversee subservice providers.
- 说明：Provide evidence beyond AI-FW records.
- 说明：Coordinate CPA tests and remediation.
- 说明：Do not present product evidence as a SOC 2 report.
常见问题
说明：Does AI-FW provide our SOC 2 report?
说明：No. Ask commercial channels about provider materials.
说明：Are gateway logs enough?
说明：No. Organisational controls and evidence are required.
说明：Do logs prove Type II?
说明：No. Type II requires period evidence and independent assessment.
一般信息，不构成法律或审计建议。