# Mesoplane

> Mesoplane is the safety layer between AI agents and your cloud. Agents ask, you approve the risky stuff, and every change is logged and reversible.

Mesoplane is the governed middle layer between AI coding agents (Claude Code,
MCP-compatible clients) and cloud accounts. Agents request typed operations;
Mesoplane enforces identity, roles, guardrail policies, and human approvals
server-side, executes with short-lived AssumeRole credentials (never stored
keys), records every action on a tamper-evident ledger, and keeps destructive
changes reversible with rollback envelopes. Customers keep a kill switch: the
IAM role lives in their account and deleting it revokes all access instantly.

## Core pages

- [Home](https://mesoplane.com/): what Mesoplane does and how it works
- [Security model](https://mesoplane.com/security/): no stored credentials, ExternalId, kill switch, audit ledger
- [Console](https://app.mesoplane.com/console/): the product itself

## Blog

- [AI Agent Observability: What to Log When Agents Act](https://mesoplane.com/blog/ai-agent-observability-what-to-log/): AI agent observability means tracing what an agent did to real systems, not just what the model said. What to log, and why it differs from LLM observability.
- [MCP Server Security: The Risks and the Fixes](https://mesoplane.com/blog/mcp-server-security-risks-and-fixes/): MCP servers give agents real tools, and real reach. Here are the concrete security risks of MCP servers and the fixes that actually hold.
- [AI Agent Guardrails That Actually Work](https://mesoplane.com/blog/ai-agent-guardrails-that-actually-work/): Prompt instructions aren't guardrails. Real guardrails are enforced outside the model: typed capabilities, risk policies, approvals, audit, and rollback.
- [What Is AI Agent Governance? A Practical Guide](https://mesoplane.com/blog/what-is-ai-agent-governance/): AI agent governance is the control layer that decides what autonomous agents can do in real systems: identity, approvals, audit, and rollback. A practical guide.
- [How to Give Claude Code Safe AWS Access](https://mesoplane.com/blog/give-claude-code-safe-aws-access/): Pasting AWS keys into an agent's environment is the new shadow IT. Safer patterns for Claude Code and any coding agent, from scoped roles to a governed broker.