AI Governance

AI governance that enforces, not just documents.

Your agents don't read the policy doc — they act. Meandr sits in the path of every tool call an agent makes and decides, in the moment, whether it runs: allow the safe ones, pause the risky ones for a human, and keep a record of every decision.

Get started See how it works

A written policy never stopped a live call.

Most "AI governance" describes what should happen. An agent firing tool calls in a loop doesn't pause to read it — so the gap between your intent and its actions is where things go wrong.

Agents act faster than review

An autonomous agent can make hundreds of tool calls before a person sees any of them. Approving each one by hand doesn't scale; ignoring them isn't governance.

Most governance is after the fact

Frameworks, risk registers, and review docs describe intent. None of them stand between an agent and the moment it does something you'd have said no to.

A rule only counts if it's enforced

A policy that nothing checks at runtime is a hope, not a control. Governance you can trust has to be able to say "no" to a specific call, as it happens.

What runtime governance means

Decide, pause, record — while it's happening.

Runtime governance isn't a document. It's three things that happen on the live call itself — before it reaches the tool.

01

Decide

Down to the arguments.

Say what an agent may do — not just which tool it can touch, but the actual values in the call: "refunds under $100, fine; over $100, no." The rule reads the real request and answers allow, block, or ask a human.

The point: the risk lives in the details, so the rule has to see them.

02

Pause

A human on the risky ones.

When a call crosses a line you've drawn, it stops and waits for a person to approve or deny — for supported clients, right inside the agent's own chat. The agent carries on only if someone says yes.

The point: oversight without babysitting every action.

03

Record

Every decision, written down.

Allowed, blocked, or held — each call becomes an audit record: who, what, when, and which rule decided. When someone asks what an agent did, the answer is one search away, not a reconstruction.

The point: governance you can show, not just assert.

Where Meandr fits.

Meandr is the control plane between your AI agents and the tools they call over MCP — the layer that turns a policy into enforced behaviour. It's not another dashboard of intentions.

Policy rules enforced at runtime — screenshot placeholder
Your rules, checked on every live call — the first match decides.

In the path, not beside it

Every tool call an agent makes passes through Meandr on its way out. Nothing routes around the policy, because the policy is on the wire.

Decides before the call runs

Allow, block, or hold for approval — settled against the real arguments and applied before anything reaches the tool. Enforcement, not a warning after the damage.

No agent code changes

Point the agent at Meandr's endpoint — standard MCP over HTTP — and governance applies. You don't rewrite the agent or wrap every tool.

Proof of every decision

Each call leaves an audit record of who, what, when, and which rule decided — metadata by default, with full request-and-response capture you can turn on per rule.

Fleet-wide limits

Cap how hard your agents can hit a server across the whole fleet — per project, per agent, per server — so one runaway loop can't run up the bill or the blast radius.

It complements your program

Keep your framework for the paperwork and evidence. Meandr is the piece that makes part of it binding at the moment an agent acts — the enforcement point, not a replacement for the whole program.

Questions you'd ask anyway.

How is this different from a GRC or AI-governance platform?
GRC and AI-governance suites help you write policies, map controls, and gather evidence — the paperwork side. Meandr is the layer that enforces a policy on live agent actions: it decides, in the moment, whether a specific tool call runs. It doesn't replace your program; it makes part of it actually binding.
Do you map to compliance frameworks or score model risk?
No. Meandr governs what agents do — their tool calls at runtime. It doesn't map controls to frameworks, classify model risk, or inventory your agents. It's the enforcement point; pair it with your governance program for the rest.
Do I have to change my agents to use it?
No. Point the agent at Meandr's endpoint — one standard MCP connection over HTTP — and the policy applies to every call. No SDK, no wrapping each tool, no agent rewrite.
What can a rule actually see when it decides?
The real call — the agent, the server and tool, and the actual argument values. That's what lets you govern a catch-all tool: "any amount over $100," "anything that starts with delete," rather than allow-or-deny the whole tool.
What happens to a call that gets denied or times out?
It never runs — nothing reaches the tool server. Whether a rule blocked it outright or a human denied it (or let the approval expire), the decision is recorded either way.

Turn your AI policy into something that actually stops the call.

Point your agent at one endpoint and you're governed in minutes — no code changes, no proxy to run.

Get started

Questions? Email us