“We think we know”
isn’t an answer

It’s the night before the board paper. The risk report is due, and every control on the dashboard is green, including the new ones for AI.

Anyone who has put one of these papers together knows what that green usually means. Either nothing was flagged, or something was but it hasn’t been confirmed yet, so it stays off the page for now. Neither tells you whether the controls actually worked.

That matters more than it used to. In a recent EY survey, about a third (36%) of leaders said an AI failure had already caused material harm to their organisation, and about half (47%) admitted skipping their own AI approval process when a launch was urgent. [1] So if the board paper still says green, the board knows less than the business does.

Why green can mislead

Most control reports only really have two settings, ‘fine or we are on fire’, and by the time it says we’re on fire, it’s usually too late. When there isn’t evidence either way, the report tends to default to fine, and nobody notices.

AI agents make this worse. They act on their own, around the clock, and much of what they do is never checked against a control. Over time, that’s how a report ends up saying everything was fine about something that wasn’t.

Look at those three payments. Without MeshLogic, the payments system is the only record. It shows every one approved under a login allowed to approve, so it reports green, and it did its job. What it can’t tell you is whether a person made the decision. With MeshLogic on the device, you can see that each of those approvals came from an AI agent calling the payments tool with a staff member’s access, two of them Daniel’s. It’s the same problem we wrote about in Seeing isn’t proving. The log names a person, but that doesn’t mean a person did it.

Three possible answers for every control

Take a simple control, where a person has to review every payment an AI agent prepares and record a decision. An honest report gives one of three answers.

1. Held. The evidence shows a person made and recorded the decision on every payment, whether it was approved, rejected or sent back for more information.
2. Did not hold. The evidence shows which payments went through without a person making that decision.
3. Insufficient evidence. We can’t tell either way, and the report says so.

That third answer is the one most reports leave out, and it’s the one boards need most. If you can’t show a control worked, you can’t rely on it. Once the gap is written down, the board can decide what to do about it, whether that’s paying for a fix or formally accepting the risk.

That way the board’s attention, and its budget, goes to the gaps that are actually there.

Where MeshLogic fits

MeshLogic’s aim is to make AI agents accountable, and those three answers for the board are one part of that. It runs on staff Windows and Mac machines, where the agents actually work, and records what each one did, including which files and systems it touched and who it was acting for. Each control is reported as held, did not hold or insufficient evidence, so where the evidence is missing, the report says so.

Records are signed on the device as they’re captured, so later tampering can be detected, and you can check the evidence yourself without relying on us. It starts in watch-only mode with nothing blocked, and you switch on enforcement when you’re ready.

MeshLogic is SOC 2 Type 2 across all five trust services criteria, AWS Qualified Software and live on AWS Marketplace.