7 New Governance Features Just Shipped in AgentMesh. All Open Source, No Waitlist. published: false

The permission model is the problem, not the model
Every AI agent incident this year has the same shape, honestly. An agent gives confidently wrong advice and a human trusts it. A trading agent moves money because nothing was in place to stop it. A shared API key means nobody can even tell which agent did what, let alone revoke just one of them.

The agent isn't malfunctioning. It's doing exactly what it was allowed to do.

AgentMesh is the open source governance proxy I built to sit between your agents and everything they touch. Token budgets, semantic caching, PII and PHI and PCI masking, prompt injection detection, audit trails, all of it enforced before a call ever reaches an LLM or a tool. It's been out in the open for a few weeks now, and this last sprint added seven features that push it past "cost and safety proxy" into something that actually answers the two questions every enterprise eventually asks: who did that, and can we stop it.

Here's what's new, with the real commands, not screenshots.

1. OpenTelemetry export Every governance event AgentMesh emits (cache hits, quota blocks, injection detections, anomalies) now streams live as OTLP spans and metrics to whatever collector you're already running. Datadog, Honeycomb, Grafana Tempo, doesn't matter which. This isn't a batch export you have to remember to trigger either. It subscribes to the live event bus and just keeps exporting for the life of the process.

agentmesh serve --otel-endpoint http://localhost:4317
No new dashboard to learn. Your platform team's existing tooling starts seeing AI governance events show up alongside everything else they already watch.

1. EU AI Act readiness scanner Full enforcement of the EU AI Act's high risk obligations lands August 2, 2026. Most teams have a compliance slide deck by now. Almost none have the actual controls, and the penalty structure isn't even uniform, which trips people up constantly. Article 5 violations go up to €35M or 7% of global turnover, but the articles that actually apply to most high risk systems, that's 12, 14, 15, and 17, top out lower, at €15M or 3%. Get those two numbers confused in public and a compliance lawyer will happily correct you. So the scanner reports whichever tier actually applies, article by article, instead of always reaching for the scariest headline number.

agentmesh compliance readiness --policy your-policy.yaml
It checks four things. Article 12: is your audit trail actually tamper evident and chain verifiable, or just a database table with delusions of grandeur. Article 14: can a human actually halt the system, or do they just get an email about it afterward. Article 15: do you have real robustness against prompt injection and data exfiltration. Article 17: is your policy versioned and evidence backed, or does it live in someone's head.

Every gap it finds comes with the specific config line that fixes it. Not just a red X.

1. Human in the loop approval An agent that can move money, delete data, or take some irreversible action without a human checking first isn't a rogue agent. It's a correctly functioning agent with a genuinely bad job description. The approval gateway lets you flag specific tools, cost thresholds, or teams as needing a real decision before the call goes through.

agentmesh serve --require-approval-over-usd 5.00 --approval-tools "wire_transfer*,delete_*"
It doesn't sit there blocking a request thread waiting on a human, which would be a bad way to build this. A matched call gets parked as PENDING, an alert fires off to Slack or PagerDuty, and the caller gets back an HTTP 202 with an approval ID. Once a human resolves it, the caller resubmits with the header X-AgentMesh-Approval-Id and it goes through. If nobody responds in time, it fails closed. No response means no action, not the other way around, and that distinction matters more than it sounds like it should.

agentmesh approval list
agentmesh approval approve APR-a1b2c3d4 --by security-team

1. Per agent virtual keys Most enterprises run every single AI agent off one shared vendor API key. No way to tell which agent did what. No way to revoke one compromised agent without breaking every other one at the same time. Virtual keys fix this right at the proxy layer. Each agent gets its own amk_live_... key, scoped and revocable on its own, and the real vendor key never leaves the proxy. The agent never even sees it.

agentmesh keys create nightly-triage-bot --team engineering --scopes "claude-code,cursor"
agentmesh keys revoke vk_a1b2c3d4 --reason "rotated"
Keys are stored hashed with SHA-256, same idea as password storage. Lose one and you revoke and reissue. You don't get it back, and that's on purpose.

1. MCP governance wrapper LLM call governance alone has a real blind spot. By the time an MCP tool call actually happens, the LLM call that requested it has already been governed and already returned. A database read with no row level scope, or an agent delegating to another agent and just handing over its entire permission set, none of that ever passes through LLM call governance. It only shows up at the tool boundary, if it shows up at all. agentmesh wrap puts the same PII scanning, injection detection, scope enforcement, and approval gating in front of any MCP stdio server.

agentmesh wrap --agent-id triage-bot --pii-mode mask --approval-tools "wire_transfer*,delete_*" -- python my_mcp_server.py
A blocked or pending call never reaches the wrapped server at all. It gets answered with a JSON-RPC error directly. Everything else, tool listing, resources, prompts, passes through untouched.

1. Compliance policy packs AgentMesh already shipped pre built governance policies for the regulatory shapes people actually run into. HIPAA clinical, EU AI Act high risk, fintech and SOX, an enterprise baseline. They were just sitting in the repo with no real way to find or install them, which was kind of a waste. Now it's one command.

agentmesh policy list-packs
agentmesh policy install eu_ai_act_high_risk
The eu_ai_act_high_risk pack routes anything matching score_, screen_, deny_, or reject_ through human approval automatically. Article 14 compliance as a default, not something you have to remember to configure yourself. The fintech pack does the same thing for wire_transfer* and send_payment*.

1. A demo that's actually real

agentmesh demo
No API keys, no network calls, and definitely no scripted animation pretending to be a product. This runs the actual PIIScanner, InjectionDetector, BudgetEnforcer, AuditTrail, and ComplianceReporter classes live. A prompt gets PII masked right in front of you. An injection attempt gets blocked and it tells you which rule caught it. A simulated runaway loop hits a hard budget cap and actually stops. And it closes out by generating a real signed audit trail plus an EU AI Act readiness report. If you want to know whether any of this is real before digging through source code, this is the fastest way to find out.

The Chrome extension got faster too
Not a new feature exactly, but worth mentioning if you've used the extension before. Every prompt typed into Claude.ai, ChatGPT, or Gemini used to pause for a governance round trip and then make you click a second time to actually send it. That's fixed now. The real send fires immediately, and governance feedback like cache hits or quota warnings shows up afterward as a small toast that never blocks anything, and only when there's actually something worth knowing.

Try it

pip install agentmesh-proxy
agentmesh demo
All of this is open source, Apache 2.0, on GitHub right now.

github.com/anilatambharii/agentmesh

If any of this saves your team a compliance headache or an actual incident, a star helps the next person find it. PRs welcome too, especially on policy packs for verticals we haven't covered yet.

Anil Prasad builds AI that survives contact with the real world. Co-founder of GenomicsIQ (World Economic Forum cohort), builder of Aria RCM, an eleven agent healthcare platform running in production, and a BCG Aleph alum. AgentMesh is the governance layer he wished existed before he had to go build eleven agents inside a regulated business himself.

If you run AI tools across a team and your bill is outgrowing your usage, clone it, run agentmesh demo, and tell me where it breaks. What would you build on top of this?

Originally published in my newsletter, Field Notes: Production AI. Find me at anilsprasad.com or on X at @anilsprasad.