Runtime AI Governance

Govern AI agents at the moment they try to act

Policy documents and prompt guardrails do not control what happens when an agent calls a tool, changes infrastructure, submits data, or triggers a workflow. Runtime AI governance puts an enforceable checkpoint in the execution path.

SMERC is a pilot-grade implementation of that checkpoint. It evaluates recoverability, action evidence, authority context, rollback latency, containment strength, anomaly pressure, and blast radius before execution.

ALLOW THROTTLE FREEZE DENY ESCALATE

Scan MCP tools Review GitHub Actions pilot Open 5-minute proof

Definition

Runtime governance decides before execution

Runtime AI governance is the operating layer that evaluates proposed AI-agent actions as they move from intent to tool use. It answers whether the action should execute now, whether it needs limits, whether it should pause for human review, and what evidence should be preserved for replay.

SMERC focuses on the missing operational question: if the action is wrong, can the organization recover quickly and prove what happened?

Execution Path

Where SMERC sits

Agent proposes action Policy and evidence context SMERC recoverability check Route or approval Replay evidence

SMERC is not a model. It is not a prompt template. It is a runtime permission layer for proposed actions: deploy, delete, move data, modify access, call sensitive tools, submit workflow changes, or trigger external side effects.

Claim Boundary

Pilot-grade, not production-certified

SMERC has public code, tests, demos, a REST API, GitHub Actions materials, MCP tool governance materials, replay evidence, and review pages. It does not yet claim customer-validated incident reduction, compliance certification, or replacement of IAM, OPA, AI gateways, SIEM, approval workflows, or human accountability.