MeshGuard Regulated Industry Blueprints

Reference deployment and evidence packages for regulated agent governance of AI agents.

These blueprints are implementation starting points, not compliance certifications. External review, customer environment validation, auditor review, and contractual artifacts are required before claiming compliance.

Blueprints

• hipaa - electronic protected health information controls, PHI policy guardrails, access logs, breach-investigation evidence, and BAA workflow inputs.
• fedramp-moderate - Rev. 5 Moderate control family mapping, FIPS/FedRAMP deployment posture, SSP boundary content, and continuous-monitoring evidence.
• finra - broker-dealer supervision, SEC 17a-4 retention posture, immutable agent communications evidence, human approval, and WORM-compatible export.
• soc2 - security, availability, confidentiality, processing integrity, and privacy readiness evidence.

Production Blueprint Contract

Each production-ready blueprint includes:

• A reference deployment topology with control-plane, gateway, sidecar, egress, identity, SIEM, key-management, and archive boundaries.
• A Terraform bootstrap that creates MeshGuard agents, policies, and alert channels with environment-specific metadata.
• A policy pack that can be applied through the MeshGuard Terraform provider or CLI.
• An evidence map that names control objectives, required events, export cadence, retention target, and accountable owner.
• An operating runbook covering preflight, daily operations, evidence export, exception handling, incident response, and quarterly control review.

Common Deployment Baseline

Control area	Required baseline
Tenant boundary	Dedicated MeshGuard tenant or dedicated deployment for regulated workloads; production and non-production separated.
Identity	Human SSO with MFA, SCIM-provisioned roles, short-lived admin sessions, and agent identity bound to SPIFFE/JWT claims.
Policy lifecycle	Policy-as-code with pull-request review, signed bundles, versioned deployment, break-glass workflow, and rollback plan.
Runtime enforcement	MeshGuard gateway in front of every agent tool call, guardian sidecar for local enforcement, and egress proxy for outbound network control.
Audit	Append-only audit stream with hash-chain or Merkle proof, independent witness anchor, SIEM delivery, and offline verification.
Evidence	Signed evidence bundle for the reporting period with policy versions, identity events, admin actions, agent decisions, alerts, and attestation.
Key management	Customer-managed key option for dedicated and customer-operated deployments; rotation evidence retained with audit export.
Data minimization	Prompt, response, and tool payload logging configured by data class; sensitive payloads redacted before centralized analytics.
Monitoring	Alert channel for deny spikes, policy drift, identity changes, sidecar bypass attempts, and evidence export failures.

Evidence Bundle Manifest

Every blueprint expects a signed evidence bundle with this manifest shape:

{
  "bundle_id": "evb_2026q2_hipaa_prod",
  "blueprint": "hipaa",
  "tenant_id": "tn_customer_prod",
  "period": {
    "from": "2026-04-01T00:00:00Z",
    "to": "2026-06-30T23:59:59Z"
  },
  "included": [
    "agent.decision",
    "policy.change",
    "identity.assignment",
    "operator.action",
    "system.alert",
    "evidence.export"
  ],
  "integrity": {
    "hash_algorithm": "sha256",
    "root_hash": "hex-encoded-root",
    "signature": "detached-jws-or-cose-signature",
    "witness_proof": "transparency-log-proof"
  },
  "attestation": {
    "prepared_by": "compliance@customer.example",
    "approved_by": "security-officer@customer.example"
  }
}

Authoritative Reference Links

• HIPAA Security Rule: https://www.hhs.gov/hipaa/for-professionals/security/index.html
• FedRAMP Rev. 5 baselines: https://www.fedramp.gov/baselines/
• SEC 17 CFR 240.17a-4: https://www.ecfr.gov/current/title-17/section-240.17a-4
• FINRA Rule 4511: https://www.finra.org/rules-guidance/rulebooks/finra-rules/4511