# AI agent governance and decision assurance

Canonical: https://www.meshqu.com/ai-decision-governance

Govern AI agents at the point of decision. MeshQu makes rules, evidence and human authority explicit, and keeps a signed Decision Receipt of each assessment.

## Put agents to work. Keep the accountability.

MeshQu assesses proposed decisions against approved policy, highlights evidence and human-review requirements, and returns a verdict with a signed record.

## Your agent can stay your agent.

Most teams already have an agent at work, or are building one. It gathers information, reasons over a case and proposes what should happen next. MeshQu does not replace it.

At the point a consequential decision is made, your agent, or the application around it, calls MeshQu. MeshQu assesses the proposed decision against the policy your organisation approved and returns a verdict. Your systems decide what happens next.

The same applies to a general-purpose assistant your team has configured, an internal agent or a custom application. Whichever one proposes the outcome, the decision is assured the same way. Bring your own agent through MeshQu’s OAuth-secured MCP server or documented API.

You can also use your own agent to work with MeshQu itself. Working with MeshQu, your agent turns the requirements in your source material into rules MeshQu can apply, and flags what the source leaves unclear for your people to settle and ratify. It can also check a case against the policy in force and ask questions of the decisions you have recorded. None of this needs an autonomous business workflow, and the decision itself can stay with your team.

## Your agent. The assurance layer. The decision.

Your agent: Gathers information, reasons over the case and proposes an outcome.

MeshQu: The proposal is checked against the policy version in force: what must be true, the evidence and who may decide.

Your systems: Act on the verdict: proceed, route the case to a person, or stop.

Decision Receipt: A signed record of the assessment: the policy version, the context supplied and the outcome.

MeshQu assesses. Your application acts. The agent remains yours.

## An agent can reason. Authority still has to be granted.

Agents are good at the work around a decision. Whether a proposed outcome can stand is a separate question, answered by the rules, evidence and authority your organisation has approved.

What the agent does
- Gathers information from the systems it can reach
- Identifies which rules a case touches
- Evaluates the case and proposes an outcome
- Surfaces ambiguity it cannot resolve

What stays governed
- The rules your organisation approved and ratified
- Evidence the policy requires, linked by reference
- The scope of what the agent may decide alone
- The point where a person must review or approve

## Decide in advance where a person has to decide.

Outcomes reserved for people: The policy says which outcomes an agent may not settle alone. The agent prepares the case; an authorised reviewer makes the call.

Cases beyond the agent’s scope: Cases outside the agent’s authority, or above a threshold, route to the right level of review.

Questions a rule cannot settle: Where a question needs interpretation, a reviewer’s judgement and rationale are recorded with the case.

Overrides on the record: An override or exception becomes its own linked record, with who acted and why, as your systems record it.

## From governing source to Decision Receipt.

A fictional supplier onboarding policy, an agent that works cases under it, and the people who keep authority over the outcome.

The agent works out what must be true and gathers evidence. People ratify its interpretation and approve the outcome. Each recorded assessment is signed, and the reviews are linked records alongside it.

## What you have afterwards.

Each recorded assessment has a Decision Receipt. A log tells you what a system did. A Decision Receipt keeps what governed the decision: the policy version, the context and evidence references supplied, the outcome and the integrity information needed to check it later.

- Signed. Integrity and signature checks together show whether the record has changed since it was created.
- Version-aware. The receipt is tied to the policy version that governed the assessment. A later policy change does not rewrite it.
- Evidence-bound. Evidence is bound by reference and digital fingerprint. Source documents stay with your team or custodian.

Actor identifiers, export and the full receipt structure are covered in the [receipt reference](https://docs.meshqu.com/concepts/receipt-reference).

The sample below is a separate signed sandbox record from a synthetic fraud review. It shows the structure of a receipt, not the walkthrough above.

## Ask the decision later.

Receipts linked across reviews, exceptions and approvals become a history of how governed decisions were made. MeshQu keeps that history, and you can question it there or through your own agent: which checks keep sending cases to review, where evidence is often missing, which policy version applied when.

These questions are illustrative. What you can ask depends on what your deployment records. [See how recorded decisions can be explored](/receipts).

## What a Decision Receipt establishes.

The recorded basis
- The policy version the assessment used.
- The context and evidence references supplied.
- The verdict, the outcome and the linked reviews.
- A signature that can be checked against trusted keys.

A separate judgement
- Whether the inputs were true and complete.
- Whether the agent’s reasoning was sound.
- Whether the decision was legally correct, fair or right.

## Follow the decision further.

Human-in-the-loop automation: Automate the checks in a review process while people keep authority over the outcome.

Enhanced due diligence: Make each EDD decision easier to review and to evidence.

What a Decision Receipt records: The record behind each assessment, how receipts link and what verification can show.

## AI agent governance, and bringing your own agent

MeshQu does not replace your agent. At the point a consequential decision is made, your agent, or the application around it, calls MeshQu. MeshQu assesses the proposed decision against the policy your organisation approved and returns a verdict with a signed Decision Receipt; your systems decide what happens next. Bring your own agent through MeshQu’s OAuth-secured MCP server or documented API.

Machine-readable: https://www.meshqu.com/knowledge/ai-decision-accountability.json