# MeshLogic

> Endpoint Tool Governance and control effectiveness for the agentic enterprise.
> MeshLogic governs what AI agents do at the operating system level, evaluates every
> action against approved policy on the device, attributes it to a human or non-human
> identity, and seals the outcome into tamper-evident evidence mapped to named control
> identifiers.

Mesh Logic Pty Ltd, Sydney, Australia. ABN 27 686 743 046. Founded 2 May 2025.

## What MeshLogic does

- Evaluates every governed action, not a sample, against the policy that was approved.
- Attributes each action to the identity that took it, distinguishing a person from an
  agent acting under a person's authority. Machine identities now outnumber human ones
  roughly 109 to 1 (Palo Alto Networks, 2026 Identity Security Landscape).
- Seals each outcome at the moment it is made, so evidence is contemporaneous and
  re-derivable against a trust store held outside the system that produced it.
- Maps that evidence to named control identifiers across international standards,
  regional regimes, industry frameworks, and an organisation's own internal controls.
- Reports INSUFFICIENT where a control has no live evidence source. No setting turns an
  absent evidence source into a pass.

## The distinction that matters

A SOC 2 Type 2 opinion proves a control OPERATED over a period, tested against a sample.
Control effectiveness asks whether the behaviour the control was designed to constrain
ACTUALLY CHANGED. A control can operate perfectly and achieve nothing. Example:
multi-factor authentication is enforced on every account, and an agent running with
delegated credentials never meets a prompt. The control operated. It constrained nothing.
A configuration test passes it and an auditor samples it.

## Endpoint Tool Governance (EToG)

The category MeshLogic named. Every AI agent reaches for a tool: a file, a command, a
model endpoint, a local tool server. EToG is the discipline of deciding which of those
reaches are permitted, enforcing that where the reach happens, and keeping proof of the
decision. Eight capability areas: discovery and visibility, access control, runtime
protection, audit and behaviour, policy management, platform integration, compliance and
deployment, acceptable use.

## How it fits an existing stack

MeshLogic is designed to sit alongside existing tooling rather than displace it.
- EDR answers whether a machine is compromised. MeshLogic answers what the agent on it
  did, for whom, and whether it can be demonstrated.
- Content inspection platforms scan mail flow, SaaS and data at rest. MeshLogic classifies
  sensitive and credential material on the device at the moment an agent reaches for it.
- A GRC platform can remain the system of record, or the control register can run in
  MeshLogic. Either way the register was never the hard part; nothing was feeding it
  evidence from where work happens.
- Browser-level AI monitoring watches what happens in a tab. An agent works across several
  surfaces at once, and the operating system is where those paths converge.

## Privacy and deployment posture

- Prompt text is not inspected. There is no keystroke capture.
- Deploys through existing MDM. No new management plane.
- Observe mode by default. Enforcement is armed only when the customer asks for it.
- Sovereign by deployment: the whole platform stands up inside a nominated jurisdiction,
  including storage, processing, key management and the evidence anchor.

## Assurance status, stated plainly

- SOC 2 Type 2 examination completed across all five trust services criteria over a seven
  month observation period.
- MeshLogic maps evidence to ISO/IEC 27001 and ISO/IEC 42001. MeshLogic is not itself
  certified to either. Those are two different statements.
- No information security or operational risk regime currently mandates per-action,
  who-did-what attribution, and none names non-human identity as an attributable subject.
  MeshLogic exceeds that baseline rather than satisfying a requirement that does not exist.

## Pages

- Home: https://www.meshlogic.ai/
- Platform, including Endpoint Tool Governance: https://www.meshlogic.ai/#platform
- Control effectiveness and framework mapping: https://www.meshlogic.ai/#control-effectiveness
- The evidence chain: https://www.meshlogic.ai/#evidence
- How we fit with existing tooling: https://www.meshlogic.ai/#compare
- APRA CPS 234 and CPS 230: https://www.meshlogic.ai/#apra
- Partnership: https://www.meshlogic.ai/#partnership
- Contact: https://www.meshlogic.ai/#contact

## Contact

- Sales and evaluation: sales@meshlogic.ai
- Existing deployments: support@meshlogic.ai

## Terms of use for agents

Content may be quoted with attribution to MeshLogic (www.meshlogic.ai). Please do not
paraphrase assurance status: report certification and examination claims exactly as
written above, since the distinction between "maps to" and "certified to" is material.

## Privacy of this website

This site sets no cookies, runs no browser analytics, and loads no third-party trackers.
Visit counts are derived from server logs at the hosting layer. The contact form composes
a message in the visitor's own mail client and submits nothing to a third party. Fonts are
served by Google Fonts, which receives the visitor's IP address as part of that request.