Mezmo Governance for AURA agents

The safe calls run.The risky ones ask.

Before an agent's tool call runs, Mezmo Governance checks it against policy. Routine calls go through on their own. Risky ones land in Slack, where the right person approves or denies them in one click. Forbidden ones never run.

Join the closed beta See a decision up close

Works with AURA, Mezmo's open-source harness for production agents.

sre-copilot Investigating p99 latency on payments-api AURA
  1. get_podsnamespace=payments-prodAllowed
  2. fetch_logsservice=payments-apiAllowed
  3. kubectl_applyconfigmap/payments-api Needs approvalApprovedDenied

    Rule “Production writes” is holding it for an approverApproved by Dana Okafor in Slack after 2m 11sDenied by Dana Okafor in Slack. The call never runs.

  4. Agent paused until someone decides. get_podsnamespace=payments-prodAllowed Agent stopped. The denial is returned to it as the reason.

Posted to #agent-approvals

agent-approvals
MezmoAPP2:03 PM

@oncall-approvers

Approval neededRequest approvedRequest denied

Agent: sre-copilotPolicy: Production Change Control

Tools: kubectl_apply

Reason: Writes to cluster:prod require an on-call approver.

ApprovedDenied by @Dana Okafor Today at 2:05 PM

Open in Mezmo

Try it: approve or deny the request.

  • AllowRoutine calls don't waitCalls that match an allow rule run right away. Nobody gets paged.
  • ApprovalRisky calls reach the right personHeld calls post to the policy's Slack channels for its approvers to decide.
  • DenyForbidden calls never runA deny rule refuses the call before it executes, and the agent is told why.
  • RecordEvery decision is keptWhat decided it, under which rule and policy revision, who approved, and why.

Governance Overview

See where your agents wait on people.

The Overview shows how agents use tools, where policy steps in, and how long agents wait on a decision. Use it to find the approvals worth turning into allow rules, and the agents still running without a policy.

app.mezmo.com/acme/governance/overview

Governance Overview

How agents are using tools, where policy steps in, and where people are the bottleneck.

Last 24 hours Refresh

Evaluated requests

18,412

tool requests in the past 24 hours

Pending approvalsReview →

3

Oldest waiting 7m · workflows need a decision

Mean time to decide

2m 41s

from escalation to a human decision

Automation rate

96%by policy rules

17.7k auto735 to a human

Enforcement outcomes

Tool requests by policy decision · past 24 hours · click a series to isolate it

Tool activity

Top 5 MCP tools · past 24 hours

Most used
  • get_pods6,204
  • fetch_logs4,880
  • log_search3,112
  • list_pods2,019
  • kubectl.get1,236
Most blockedToolsAgents
  • delete_pod212
  • kubectl.delete141
  • drop_table61
  • iam.attach_policy40
  • cms_publish22

Agent coverage

Active agents with a policy assigned

78% governed
  • Governed7
  • Deactivated2
  • Ungoverned2

Active with no policy

  • data-sync-botAssign
  • cost-optimizerAssign

Human approvals

Escalated requests by reviewer decision

Escalated735
Approved91%
Denied9%
Pending<1%

Waiting longest

  • kubectl_applysre-copilot7m
  • kubectl.rollout_restartdeploy-verify4m
  • cms_publishcontent-bot1m

All 3 pending →

Automation rate

The share of tool calls policy decided with no one involved. Raise it by writing allow rules for the approvals your team always grants.

Mean time to decide

How long an agent waits between escalation and a human decision. If it climbs, requests are going to the wrong channel or the wrong people.

Agent coverage

An active agent with no policy is refused every governed call. The Overview names those agents so you can assign one.

Approval requests

Decide with the agent's reasoning in front of you.

Each held call opens on one page with what the agent wants to do, why, and the rule that stopped it.

app.mezmo.com/acme/governance/workflows/wf_93d0b4
Workflow Decisions
PendingApprovedDenied wf_93d0b4·Oct 15, 2026 14:03

Restore the payments-api connection pool to 50 to fix the p99 spike.

1 call

1 call needs your approval

The reason you enter is recorded on the decision and returned to the agent.

Approved by you
Tool calls · 1 callSave workflow as ▾
kubectl_applyk8s_mcpApproval

Restore the payments-api connection pool to 50 to fix the p99 spike.

namespace payments-prodmanifest configmap/payments-api.yamlpool_size 50

PROD_WRITE_GATEDWrites to cluster:prod require an on-call approver.

Request debug info
Agent
sre-copilot
Agent Instance
aura-instance-ab12cd34
Policy
Production Change Control
Scope
cluster:prod-us-east
Origin
mcp-gateway
Request Id
req_8fd12a
Decision Id
4c1e9a70-2b6d-4f3e-9d52-07a8e1c3b6f4

Timeline

  1. Workflow recorded1 call · 14:03:02
  2. Policy evaluatedEscalated to the approval queue.
  3. Awaiting approverPlatform Approvers
  4. ApprovedReason returned to the agent.
  5. DeniedReason returned to the agent.

Agent & Policy

Agentsre-copilot
PolicyProduction Change Control
Revision14

This screen works. Edit the reason, then approve or deny the request.

Intent with every call

The agent says what each call is for, so you aren't guessing from arguments.

The rule that held it

See the rule's code and the exact message the agent was given.

Your reason goes back

The agent gets your reason word for word, so it can adjust instead of retrying blind.

Slack approvals

Approve from Slack. The same checks still apply.

Each policy can post approval requests to up to 10 Slack channels and mention @here, @channel, a person, or a user group. Approve and Deny work right inside the message.

The approver role still decides
A click only counts when the Slack account is linked to a Mezmo user who holds the policy's approver role. Anyone else gets a private note, and nothing is decided.
Every button asks first
Once an agent acts there's no undo, so Approve and Deny each ask for confirmation.
One message, kept current
When someone decides, the message updates for the whole channel with who decided and when.
No secrets in the channel
Messages name the agent, the policy, and the tools. Tool arguments stay in Mezmo.
What the channel sees after a decision
platform-oncall
MezmoAPP11:40 AM

Request approved

Agent: deploy-verifyPolicy: prod

Tools: kubectl.rollout_restart

Reason: Restarting a rollout needs a human approver before it can run.

Approved by @Jack Burton Today at 11:42 AM

Open in Mezmo
What someone sees if their Slack account isn't linked to Mezmo

Only visible to you

MezmoAPP11:41 AM

Link your Slack account to your Mezmo user to approve and deny requests from Slack. Nothing was approved or denied.

Link your Slack account

Safety defaults

When something's wrong, the answer is no.

Governance sits in front of production, so every edge case resolves toward refusing the call and telling the agent why.

Unknown agents get no decision

An unregistered or deactivated agent, or one with no policy, is refused before any rule runs.

No default fallthrough

Calls no rule covers go wherever the policy says. Someone chose that when the policy was created.

Errors deny

If a rule can't be evaluated, the call is denied.

Only people approve

Agents and service accounts can't approve or deny a request, including their own.

Role checked at decision time

The approver must hold the policy's approver role directly. If that check can't complete, nothing is decided.

One decision per request

An approval covers one request under one policy revision. It can't be reused or decided twice.

Decision record

Months later, you can still explain the decision.

Every decision keeps a frozen copy of what decided it: the agent, the policy revision, each rule and how it evaluated, who approved, and the reason they gave. Edit or delete the policy later and the record still reads the same.

  • The rule that decided is kept apart from the rules that merely matched.
  • Refused approval attempts are recorded too.
req_5b2e90frozen at decision time
Agent
deploy-verify · aura-instance-7e21f0c9
Policy
prod, revision 9
Call
kubectl.rollout_restart · deployment=payments-api
Rules evaluated
6 rules, every result kept
Decided by rule
Restart needs approval · ROLLOUT_GATED
Outcome
Approved
Approver
Jack Burton · Platform Approvers
Reason
“Canary is healthy, roll the rest.”
Escalated → decided
11:40:07 → 11:42:31 (2m 24s)

Architecture

Agents run in your environment. Mezmo makes the call.

AURA runs the agent, its tools, and its models where you deploy it. Before a governed call runs, AURA asks Mezmo for a decision and enforces the answer locally. Mezmo keeps the policy, the approval queue, and the record.

You keep control of your RuntimeToolsModelsTelemetry

Policies

Turn repeat approvals into rules.

When the Overview shows your team granting the same call every time, write the allow rule and stop paging people for it.

app.mezmo.com/acme/governance/policies/production-change-control

Production Change Control

Guards production writes for the platform agents.

Run Evaluation
Revision14
ApproversPlatform Approvers
Slack notifications#agent-approvals@oncall-approvers
Agents3

Compiled Rules

  • Allow
    Read-only cluster calls

    When the tool is one of get_pods, fetch_logs, kubectl.get → allow the call.

    Expand Rule
  • Approval
    Production writes

    When the tool namespace is k8s_mcp and the tool is one of kubectl_apply, kubectl.rollout_restart → send it to an approver.

    Expand Rule
  • Approval
    Large scale-ups

    When the tool is kubectl.scale and argument "replicas" is greater than 10 → send it to an approver.

    Expand Rule
  • Deny
    Block pod deletes

    When the tool is delete_pod → refuse the call.

    Expand Rule
Anything no rule above covers:DenyDenied outright with NO_MATCHING_RULE: “No rule in this policy covers this request.”
BasicsFallthroughRulesApproversReview

What happens to a call no rule permits?

There is no default here on purpose. Denying a call, routing it to a person, or waving it through is too consequential to inherit silently.

Deny OutrightThe call fails immediately with your code and message. Nothing reaches a human queue.
Send for ApprovalUnmatched calls pause and route to an approver. Safer for rollout, noisier for on-call.
AllowUnmatched calls go through untouched. Rules become the exceptions, so only pick this for a policy that exists to block specific calls.

Test Suite

12 cases
Live · 12 of 12 passDraft · 11 of 12 pass

Draft changes this: “Restart in staging” now needs an approver.

Revision History

  1. Revision 14Edited · Oct 14Tests passed
  2. Revision 13Forked · Oct 2Tests passed
  3. Revision 12Reverted · Sep 28Untested

Rules read as sentences

Each rule compiles to Cedar and is checked before the policy can be saved.

Tested before it ships

Test cases run against the draft and the live rules. Save any real request as a test case.

Easy to undo

Drafts never touch the live policy. Every accepted change is a revision you can fork or revert.

Closed beta

Give agents production access. Keep the final say.

Mezmo Governance is in closed beta for teams running AURA. Join with your work email and bring a change your team approves by hand today. We'll show you the policy that handles most of it and the Slack message for the rest.

Prefer to talk it through first? Talk to an engineer