> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance Overview

> Unified governance for AI agents - policies, approvals, audit trail, risk classification, and compliance

MeshAI's governance engine lets you define, enforce, and audit rules across every AI agent in your organization. It covers five areas:

<CardGroup cols={2}>
  <Card title="Policies" icon="shield-halved" href="/governance/policies">
    Eight policy types, with enforcement that varies by type - some block inline at the proxy, others are recorded as evidence. Block models, cap budgets, require approval, and more.
  </Card>

  <Card title="HITL Approvals" icon="user-check" href="/governance/approvals">
    Human-in-the-loop workflow. The proxy blocks requests that require approval and queues them for your team to review.
  </Card>

  <Card title="Risk Classification" icon="gauge-high" href="/governance/risk-classification">
    EU AI Act risk levels (minimal, limited, high, unacceptable) assigned to each agent. AI-assisted suggestions available.
  </Card>

  <Card title="Audit Trail" icon="scroll" href="/governance/audit-trail">
    Immutable log of every governance action. Filter, search, and export for compliance audits.
  </Card>
</CardGroup>

## How It Works

Governance enforcement happens at two layers:

1. **Proxy layer** - `model_allowlist`, `block_provider`, and `require_approval` policies are evaluated inline on every LLM request and can block it with a `403`. `budget_limit` and `rate_limit` are enforced separately at the proxy-key/team level (`429`). Prompt injection scanning is always-on, independent of policies. See [Enforcement model](/governance/policies#enforcement-model) for the full picture, including policy types that are evidence-only today.
2. **API layer** - registration, classification, and administrative actions go through the API directly; they are not policy-gated by the proxy.

```
Agent Request → MeshAI Proxy → Policy Engine → Allow / Block (403)
                                    ↓
                              Audit Event logged
```

## Quick Start

<Steps>
  <Step title="Register your agents">
    Use the [SDK](/sdk-reference/agents) or [API](/api-reference/agents) to register agents with framework, model, and environment metadata.
  </Step>

  <Step title="Classify risk">
    Assign an [EU AI Act risk level](/governance/risk-classification) to each agent. Use the AI-assisted suggestion endpoint for guidance.
  </Step>

  <Step title="Create policies">
    Define [policies](/governance/policies) - model allowlists, budget limits, approval requirements - scoped globally or per-agent.
  </Step>

  <Step title="Monitor the audit trail">
    Every action is recorded in the [audit trail](/governance/audit-trail). Export events for compliance reporting.
  </Step>

  <Step title="Check readiness">
    Use the [readiness score](/governance/readiness-score) to measure your organization's EU AI Act compliance posture.
  </Step>
</Steps>

## EU AI Act Compliance

MeshAI maps directly to EU AI Act requirements. See the dedicated pages:

<CardGroup cols={2}>
  <Card title="EU AI Act Coverage" icon="flag-eu" href="/governance/eu-ai-act">
    Article-by-article mapping of what MeshAI covers.
  </Card>

  <Card title="FRIA" icon="file-shield" href="/governance/fria">
    Fundamental Rights Impact Assessments (Article 27).
  </Card>

  <Card title="Incident Reporting" icon="siren" href="/governance/incidents">
    Serious incident reporting per Article 73.
  </Card>

  <Card title="Readiness Score" icon="chart-line" href="/governance/readiness-score">
    7-component compliance score (0–120).
  </Card>
</CardGroup>