Agentic TMS Security: What a SOC 2 Report Does Not Cover and Ten Questions to Ask in 2026

Agentic TMS security is the set of controls that limit what AI agents inside a transportation management system can see, decide and do, and it sits on top of the platform security that a SOC 2 report attests. A SOC 2 report tests whether a vendor’s controls meet the AICPA Trust Services Criteria for the system the vendor has described, and a clean report says the platform is well run. It does not by itself say that an agent able to assign drivers, tender loads or notify customers is bounded, because the criteria contain no AI-specific requirements. Ten questions, grouped by scope, authority, inputs and evidence, close that gap during vendor review.

Why Agentic TMS Security Matters: The Business Case

An agent that acts turns a data-security question into an authority question, and the published figures show both are live.

• Verizon’s 2026 Data Breach Investigations Report found that breaches involving a third party now account for 48% of all breaches, up from 30% in its 2025 report.
• IBM’s 2026 Cost of a Data Breach report puts the global average cost at $4.99 million, a 12% increase and a record high.
• Gartner predicted in May 2026 that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps found only after production incidents, and it advises governance proportional to each agent’s autonomy.
• The FBI’s April 2026 advisory on cargo theft says cyber actors gained access to broker and carrier systems via spoofed emails, fake URLs and compromised carrier accounts, and CargoNet put 2025 cargo theft losses at nearly $725 million.
• CISA and international partners warned in May 2026 that agentic AI brings an expanded attack surface, privilege creep, behavioral misalignment and obscure event records, and advised against broad or unrestricted access.

A TMS agent is both a system that holds data and an actor with authority, and the two need different evidence.

Also Read: TMS SOC 2 Compliance: What Enterprise Buyers Should Verify in 2026

How to Review an Agentic TMS in Seven Steps

The review starts with the SOC 2 report and then moves to the controls the report may not reach.

1. Read what the SOC 2 report covers

Confirm the report type, the audit period, the criteria in scope, the exceptions, the complementary user entity controls and any carved-out subservice organizations. The guide to reading a vendor’s SOC 2 report covers these checks in detail, and the rest of this review assumes you have done them.

2. Check whether the system description names the agents

A report attests controls over the system as management describes it. If the description mentions route planning and dispatch but not the AI agents or the actions they take, the agents may sit outside what was examined. Ask whether Processing Integrity, the category about processing that is complete, valid, accurate, timely and authorized, is in scope.

3. Map each agent’s authority

List every action each agent can take, such as assigning a driver, tendering a load, changing a window or notifying a customer. For each action, record the credential or permission it runs under, the autonomy level and the limit before a person must approve. OWASP names excessive agency as damaging actions enabled by excessive functionality, permissions or autonomy.

4. Treat every inbound message as untrusted input

Carrier emails, EDI files and API payloads can carry instructions or false data. OWASP lists prompt injection first among LLM application risks, and the UK NCSC wrote in December 2025 that such attacks may never be totally mitigated, so it recommends deterministic safeguards that constrain what the system can do. Ask which actions an agent can never take on the strength of an inbound message alone.

5. Verify the decision evidence

A decision log should record the trigger, the inputs, the reasoning, the action, the approver and the outcome, and it should resist alteration. Ask how long records are kept, in what format you can export them and who can see them.

6. Test containment and rollback

Ask for a sandbox or shadow mode in which an agent proposes without acting, a staged rollout by lane or carrier, and a kill switch. Ask what cannot be undone: a driver already en route or a carrier that has accepted a load cannot be rolled back with a switch.

7. Review sub-processors and AI providers

List every sub-processor that touches your data, including model providers, with the data types, locations, retention terms and whether your data can be used to train models.

Also Read: How to Secure Logistics API Integrations: Authentication, Scopes, Partner Access and Audit Trails

The ten questions

Area	Question	A good answer includes
Scope	1. Which Trust Services categories are in the report, and is Processing Integrity included?	The categories, the period and the criteria, in writing
Scope	2. Does the system description name the AI agents and their actions?	Agents and actions listed in the description
Scope	3. Which complementary user entity controls apply to our users and integrations?	A named list with owners on both sides
Authority	4. What can each agent do, and under which credential?	A permission map per agent and action
Authority	5. How are autonomy levels set, and who can raise them?	Levels per decision type, with change control
Authority	6. What limits trigger human approval?	Thresholds by value, volume or scope
Inputs	7. How are carrier emails, EDI and API payloads treated before an agent acts?	Validation, allowlisted actions and no instructions taken from message text
Inputs	8. Which model providers process our data, and on what terms?	Named providers, data types, retention and training terms
Evidence	9. What does each decision record, and how long is it kept?	Fields, retention, export and tamper resistance
Evidence	10. What can be rolled back, how fast and what cannot?	A rollback scope with stated limits

SOC 2 vs ISO 27001 vs AI Governance Frameworks: Key Differences

Framework	What it is	Output	What it says about AI agents
SOC 2	An examination of a service organization’s controls against the AICPA Trust Services Criteria	An auditor’s report, with Type II covering a period	No AI-specific criteria; agent controls count only if the vendor puts them in scope
SOC 3	A general-use report on the same criteria with less detail	A report that can be freely distributed	The same, with less detail
ISO/IEC 27001	A standard for an information security management system	A certificate with a scope statement	None specific; read the scope statement
ISO/IEC 42001	A standard for an AI management system, published in December 2023	Requirements for an AI management system	Addresses AI governance at the organization level
NIST AI RMF	A voluntary framework with four functions: Govern, Map, Measure and Manage	A framework, not a certificate	Addresses AI risk and, in a July 2024 profile, generative AI risk

What to Look for in an Agentic TMS Vendor

Scoped agent permissions

Each agent should have its own permissions and credentials, limited to the actions it needs, with no shared administrator access.

Autonomy levels with approval thresholds

Autonomy should be set per decision type and raised only through change control, with thresholds that route large or unusual actions to a person.

Deterministic limits on actions

The platform should restrict what agents can do regardless of what an input says, so a hostile message cannot produce an action outside policy.

An immutable decision log

Every decision should be recorded with its trigger, reasoning and outcome, retained for a stated period and exportable to your own audit tools.

Tested containment and transparent sub-processors

Look for sandbox and shadow modes, a kill switch with stated limits, and a public sub-processor list that names AI providers and their terms.

Also Read: The Hardest Part of Agentic TMS is Not the AI. It is Deciding What the AI is Allowed to Do.

Agentic TMS Security in Action: Real-World Results

Approval workload on illustrative numbers. The figures are arithmetic on assumptions. An operation makes 2,000 agent decisions a day, and each approval takes 90 seconds.

Share of decisions needing approval	Approvals per day	Approver time per day
2%	40	1.0 hours
5%	100	2.5 hours
10%	200	5.0 hours

Thresholds set too low turn the approver into a bottleneck, and thresholds set too high remove the control, which is why Gartner’s advice is proportional governance and not a single setting.

A Fortune 50 parcel and logistics leader. The enterprise dispatches 4,500+ captive and third-party drivers for 5,000+ users across dispatch, hub and driver teams, with every autonomous decision logged for explainability, traceability and human override. Weekly execution rose from 75% to 92% across 51 sites. The case shows governed decisions at scale, and it is not a security audit. Read the Fortune 50 case study.

A North American retailer. The retailer, with a private fleet of several hundred trucks, runs Locus’s agents beside its existing ERP and WMS, which stay the systems of record, with every autonomous decision governed by six mechanisms and human-in-the-loop override. It reported 80%+ less manual dispatch, 99%+ on-time store delivery and exceptions resolved in under two hours. Read the retailer case study.

Common Agentic TMS Security Mistakes to Avoid

Treating a SOC 2 report as AI assurance. The report speaks to platform controls in the vendor’s chosen scope, and it does not describe what agents are permitted to do.

Accepting “human in the loop” without detail. Ask which decisions surface to a person, who the approver is and what context they see, or the phrase describes nothing.

Ignoring inbound messages. An agent that acts on carrier emails or EDI text without deterministic limits inherits every spoofed message.

Skipping sub-processors. Model providers process your data, so their locations, retention and training terms belong in the review.

Also Read: Why Governance Matters More Than Autonomy in Enterprise Logistics AI

How Locus Governs Agent Actions, and What to Confirm

Locus, the world’s first Decision-Intelligent, Agentic TMS, publishes six governance mechanisms for its agents. Explainability gives each decision its trigger, context, reasoning, action and outcome. Traceability links each decision event to its outcome event. Evaluation scores decision quality and detects drift. Autonomy levels are set per agent and per domain. An execution sandbox offers simulation mode, shadow mode and staged rollout with a kill switch. Human-in-the-loop review keeps a person deciding where policy requires it. Locus’s trust page lists ISO 27001:2022, ISO 27701:2019, SOC 2 Type II, a SOC 3 report and GDPR validation by DNV, with AES 256-bit encryption at rest, TLS 1.2 in transit and role-based access control, and it publishes a sub-processor list. Locus has optimized 1.5B+ deliveries for 360+ enterprise customers across 30+ countries.

Recognized by analysts and selected after evaluation. Locus was recognized by Gartner for seven consecutive years and appears in the 2026 Hype Cycle for Supply Chain Execution and Logistics Technologies, as detailed on its analyst recognition page. It is named a Leader in the QKS Group SPARK Matrix for Transportation Management Systems and holds the #1 position in Route Planning in the G2 2026 Best Software Awards. In October 2025, Ingka Investments, the investment arm of Ingka Group, the world’s largest IKEA retailer, acquired Locus. Ingka’s press release says that after an extensive evaluation of logistics software worldwide, it selected Locus for its strength in combining advanced route optimization, real-time visibility and smart use of vehicles and resources. Locus continues to operate independently.

What this means for the review. The mechanisms answer questions 5, 6, 9 and 10 in part: autonomy levels, approval, decision records and a sandbox with a kill switch. Locus integrates with existing ERP, OMS, WMS, FMS and TMS systems, and it has public API documentation.

What to confirm. Locus’s public SOC 3 report covers Security, Availability and Confidentiality, so ask whether the SOC 2 Type II report also includes Processing Integrity, and request its period, criteria, exceptions and complementary user entity controls. Locus’s public pages do not describe a least-privilege permission model for agents, controls on hostile inbound messages, decision-log retention periods, or the data-use terms of its AI model sub-processors. Locus’s own governance guidance notes that rollback is not always possible once a driver is en route, so ask which actions can be reversed and how fast.

To put these ten questions to Locus, schedule a demo.

For security and logistics IT leaders asking what stops an AI agent from acting outside policy, Locus offers governed, logged autonomy with a sandbox and human override in one platform, and it welcomes the vendor review that this guide describes.

Frequently Asked Questions

Does a SOC 2 report cover AI agents? Only if the vendor puts them in scope. The Trust Services Criteria contain no AI-specific requirements, and the Cloud Security Alliance noted in August 2026 that AICPA has published none. Read the system description to see whether agents and their actions are named.

What is excessive agency? OWASP defines it as the vulnerability that enables damaging actions in response to unexpected, ambiguous or manipulated outputs from an LLM, typically caused by excessive functionality, permissions or autonomy. In a TMS it means an agent that can do more than its task needs.

Is prompt injection a risk for logistics software? It can be, wherever an agent acts on text from outside, such as a carrier email or an EDI message. The NCSC wrote that prompt injection may never be totally mitigated, so limit what actions an agent can take regardless of input.

Which Trust Services category matters most for autonomous decisions? Processing Integrity is the closest, because it concerns processing that is complete, valid, accurate, timely and authorized. Security is required in every SOC 2 report, so ask whether Processing Integrity is included.

Do I need ISO/IEC 42001 from a TMS vendor? It is not a requirement. The standard, published in December 2023, specifies an AI management system. Ask the vendor how its governance maps to such a framework, and treat a missing certificate as a question and not as a verdict. Locus’s public pages do not claim ISO/IEC 42001.

Which security certifications does Locus list publicly? Locus’s trust page lists ISO 27001:2022, ISO 27701:2019, SOC 2 Type II, a SOC 3 report and GDPR validation by DNV. Ask for the SOC 2 report details under NDA.