SOC 2 compliance gets complicated when email is sent by AI agents, not humans. Here's how access controls, audit trails, and shared responsibility work.