The middle layer between agents and your cloud
AI agent governance for your cloud
Coding agents can already write your infrastructure. Mesoplane makes it safe to let them operate it — every action becomes a typed, governed operation with approvals, a tamper-evident audit ledger, and one-click rollback.
Read-only observe tier · no stored credentials · kill switch you own
Why a middle layer
Agents are ready for production. Your credentials aren't.
Pasted keys are the new shadow IT
Giving an agent your ~/.aws keys makes it exactly as
powerful as you — with none of your judgment. One wrong tool call
can delete a database.
Raw cloud APIs have no "are you sure?"
IAM says whether something is allowed, never whether it's a good idea right now. There's no approval step, no review queue, no undo.
You can't audit what you didn't see
CloudTrail tells you an API was called — not which agent, on whose behalf, in which conversation, or how to reverse it.
How it works
Connected in minutes, governed from the first call
Connect your AWS account
Launch a CloudFormation quick-create stack that creates one IAM role in your account — AssumeRole + ExternalId, no access keys, no software in your VPC. Start read-only and expand when you're ready.
Agents call governed operations
Claude Code, MCP clients, or the console all speak the same typed operation registry. Every request is validated server-side: who is asking, in which workspace, with what role, under which policy.
You stay in control
Risky actions pause for approval in the console inbox. Everything lands on a verifiable ledger with the acting agent attributed — and destructive changes carry a rollback envelope.
What's in the box
Everything between "agent wants to" and "cloud did"
Typed operation registry
One registry of governed cloud operations with declared risk tiers — not free-form shell access. Console, HTTP API, and MCP are projections of the same spine.
Approvals inbox
High-risk operations pause until a human approves them. Guardrail policies decide what runs instantly, what needs an admin, and what is refused outright.
Tamper-evident ledger
Every sensitive action is recorded with actor, workspace, and outcome. Export evidence packs and cryptographically verify the ledger hasn't been altered.
Rollback envelopes
Governed fixes capture the before-state, so "undo" is a button — not an archaeology project across CloudTrail and old Terraform state.
Connection trust & kill switch
No secrets at rest, short-lived STS sessions, per-agent SourceIdentity attribution — and revoking Mesoplane is as simple as deleting a stack in your account.
Scheduled scans & drift watch
Continuous security scans open findings, governed remediations fix them, and drift detection reopens anything that creeps back.
Security model
Built assuming the worst day happens
The design question behind Mesoplane's connection model isn't "how do we keep secrets safe" — it's "what if we get compromised?" The answer: there must be nothing worth stealing, and you must be able to cut us off without asking.
- No stored cloud credentials — AssumeRole + ExternalId, short-lived STS only.
- Customer-owned kill switch — delete the CloudFormation stack, access ends instantly.
- Fail-closed workspaces — unknown workspace or missing connection means refusal, not fallback.
- Attributed sessions — every cloud session carries the acting agent's identity via SourceIdentity.
FAQ
Frequently asked questions
What is Mesoplane?
Mesoplane is a governance layer that sits between AI agents (like Claude Code or any MCP-compatible tool) and your cloud accounts. Agents request typed operations; Mesoplane enforces roles, approvals, and guardrails server-side, executes with short-lived credentials, and records every action on a tamper-evident ledger with rollback.
How does Mesoplane connect to my AWS account?
Through a CloudFormation quick-create stack that creates a single IAM role owned by your account, trusted via AssumeRole with an ExternalId. No access keys are exchanged and nothing is installed in your VPC. You can start in a read-only observe tier and grant more later.
Can Mesoplane see or store my AWS credentials?
No. Mesoplane never stores long-lived cloud credentials. It assumes the role you created and receives short-lived STS credentials scoped to that role's policy. Deleting the CloudFormation stack instantly revokes all access — a kill switch you own.
Do AI agents get my cloud credentials?
Never. Agents don't hold credentials at all. They call governed operations, and the control plane validates every request server-side — identity, workspace, role, and policy — before anything touches your cloud.
Which AI agents and tools work with Mesoplane?
Any agent that can use skills or an HTTP API works today, including Claude Code. An MCP facade exposes the same governed operations to MCP-compatible clients. Every path shares one typed operation registry, so governance is identical no matter where a request comes from.
Does Mesoplane replace AWS IAM?
No — it builds on IAM. IAM decides what the Mesoplane role may touch in your account. Mesoplane adds the agent-aware layer IAM doesn't have: per-user and per-agent identity, approvals for risky actions, a verifiable audit ledger, and rollback.
Give your agents safe hands
Connect an AWS account read-only in minutes. Nothing to install, nothing to paste, nothing we can leak.