# ai-agent-audit-specialist

Designs tamper-evident audit trails and compliance mappings for AI coding tools under HIPAA, SOC 2, and EU AI Act rules.

- subagent · `type=agent` · Claude Code · 148 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/agents/security/ai-agent-audit-specialist.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/ai-agent-audit-specialist

## What it does

This subagent translates compliance mandates into forensic logging architectures for AI assistants like Claude Code, Cursor, Codex CLI, and Aider. It organizes event capture around agent lifecycles (`UserPromptSubmit`, `PreToolUse`, `PostToolUse`, session boundaries) and connects them to regulatory requirements such as HIPAA §164.312(b), SOC 2 CC7.2, and EU AI Act Annex IV.

It operates using Read, Grep, Glob, and Bash tools. The resulting design specifies append-only JSONL files, SHA-256 hash chaining, system-level immutability via `chattr +a` or `chflags uappnd`, SIEM pipelines (Splunk HEC, Elastic), and re-verification checks for audit teams.

Log files function as legal evidence: any log rotation that severs the hash sequence or any silent hook disabling in `settings.json` invalidates the entire verification chain.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --agent security/ai-agent-audit-specialist
```

2. **Manually: put the files in place**
- File: `.claude/agents/ai-agent-audit-specialist.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/ai-agent-audit-specialist.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/ai-agent-audit-specialist.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/agents/security/ai-agent-audit-specialist.md

## When to use it
- design tamper-evident audit pipelines for AI coding agents
- map agent hook events directly to SOC 2 and HIPAA controls
- draft logging architecture documentation for EU AI Act Annex IV
- generate scripts for auditors to verify cryptographic hash chains

## Example prompts
- Design an audit architecture capturing Claude Code tool runs and diffs for HIPAA compliance
- Build a SOC 2 CC7.2 evidence plan with continuous monitoring for coding agents
- Draft an EU AI Act Annex IV logging description covering event taxonomy and retention

## Similar
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/security-auditor.md) — subagent · 10718 installs
- [test-engineer](https://affpapa.org/en/nevibecode/agents/test-engineer.md) — subagent · 9715 installs
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 804 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md