Imagine Meridian Financial, a regulated enterprise that already uses identity systems to manage employees, applications and access. Now its teams are building AI agents in Amazon Bedrock, registering internal agents, connecting MCP servers, and using AI to summarize claims, triage support cases and automate operational work. The technology is moving quickly. The governance model is not.
The business problem
Meridian's executives do not wake up asking for another dashboard. They ask harder questions: what AI exists in the company, who owns it, what data it can touch, whether it is approved for production, and how the company can prove control to auditors, customers and regulators.
Without a control plane, the answers are scattered across AWS, internal tools, spreadsheets, team chats, app owners and screenshots. That creates real business risk: shadow AI, unclear ownership, duplicated reviews, slow approvals, unmanaged provider assets and weak audit evidence.
AuthSpoke's value is not that it stores more fields. Its value is that it turns scattered AI adoption into governed enterprise operations.
The enterprise scenario
Meridian creates a Bedrock agent called meridian-claims-assistant. It helps claims specialists summarize claim context, identify missing documents and recommend the next operational step. The agent is useful, but it also raises enterprise questions:
- Who owns the agent if it makes a bad recommendation?
- Is it production, pilot or experimental?
- Does it process confidential customer data?
- Which policies must it satisfy before broader rollout?
- What happens if AWS-side metadata changes?
- Can security prove who changed lifecycle, ownership and governance status?
AuthSpoke gives Meridian a repeatable operating model for answering those questions.
Step 1: Connect provider platforms
Meridian starts by creating an Amazon Bedrock integration instance in AuthSpoke. The connector has its own configuration, credentials, diagnostics, import preview, synchronization and activity timeline.
Business value: the enterprise no longer relies on every team manually reporting what they built. Provider discovery becomes a managed, repeatable workflow.
Step 2: Test and diagnose before importing
Before trusting the connector, Meridian runs connection tests and diagnostics. AuthSpoke validates that the credential can reach Bedrock and that permissions are sufficient for discovery.
Business value: platform teams catch broken credentials, wrong regions and missing permissions before they create bad inventory or failed audits.
Step 3: Preview provider assets before creating governed records
AuthSpoke shows what it discovered from Bedrock before import. The important distinction is signal quality: Meridian wants to govern real Bedrock agents it created, not every foundation model available in the AWS catalog.
Business value: governance teams avoid inventory noise. The registry stays focused on assets the enterprise actually owns and operates.
Step 4: Import the agent into the AI Registry
After review, Meridian imports meridian-claims-assistant into the AI Registry as a governed AI asset. AWS remains the runtime provider. AuthSpoke becomes the governance system of record.
Business value: the enterprise gains a durable record for an AI asset that can be owned, classified, reviewed, evaluated and audited across its lifecycle.
Step 5: Assign ownership and business context
The asset receives an owner, business unit, department, criticality, classification and environment. These are not just labels. They determine accountability, reporting, policy scope and review routing.
Business value: every AI asset has a responsible business owner. When risk appears, the organization knows who must review, remediate or approve an exception.
Step 6: Separate operational agents from governed assets
The Agent tab represents operational AI identities: agents that act, authenticate, access tools or participate in workflows. The AI Registry represents governed assets: things the business must own, classify, review and audit. The same real-world agent may need both views.
Business value: security teams can manage runtime identity and access while risk teams manage governance, lifecycle and audit. The two views connect instead of competing.
Step 7: Capture metadata, relationships and provider context
Meridian records business purpose, data sensitivity, user population and regulatory scope. AuthSpoke also preserves provider metadata such as Bedrock agent ID, region, source connector and import preview details. Relationships can connect an agent to models, tools, MCP servers, guardrails or business systems.
Business value: the enterprise can understand blast radius. If an agent touches confidential claims data and calls operational tools, that risk is visible before something goes wrong.
Step 8: Manage lifecycle and governance state
The asset can move through states such as discovered, registered, in review, active, deprecated or retired. Governance state can indicate whether the asset is ungoverned, pending review, governed or exempted.
Business value: leadership can distinguish between experiments and production AI. Teams can move faster because there is a clear path from discovery to approval.
Step 9: Evaluate governance policies
Meridian creates policies such as "production AI assets must have an owner" or "customer-facing agents must have guardrail evidence." AuthSpoke evaluates assets and creates results and findings.
Business value: governance becomes repeatable and testable, not a one-off spreadsheet exercise. Policy gaps become visible early.
Step 10: Review findings, exemptions and remediation
When an asset fails policy, AuthSpoke creates findings. Teams can review the issue, assign remediation tasks, approve time-bound exemptions or resolve the finding after the asset is fixed.
Business value: risk becomes workflow. The enterprise can show not only that it found a problem, but also who reviewed it, what decision was made and what work remains.
Step 11: Preserve activity and audit evidence
Ownership updates, metadata changes, lifecycle transitions, governance decisions, connector operations, imports and synchronization events are recorded as activity. This creates an evidence trail around the AI estate.
Business value: audit readiness improves. Instead of reconstructing events from emails and screenshots, teams can show a system-backed history.
Step 12: Expose everything through headless APIs
The same workflows are exposed through APIs, so the UI is not the only path. Automation, MCP servers, AI agents, server-to-server jobs and internal tools can use the same control plane.
Business value: AuthSpoke can become infrastructure, not just a screen. Enterprises can embed AI governance into CI/CD, provider sync jobs, internal portals and agent-driven workflows.
What the buyer is really paying for
- Visibility: know which AI agents, provider assets, MCP servers, models and tools exist.
- Accountability: every production AI asset has an owner and business context.
- Control: lifecycle, governance state, policy evaluation and findings create a managed operating process.
- Audit readiness: decisions, changes, reviews and exemptions become evidence.
- Risk reduction: shadow AI and unmanaged provider assets become visible before they create incidents.
- Speed: AI teams move faster because the review path is clear, repeatable and documented.
- Extensibility: APIs let the enterprise connect AuthSpoke to agents, automation and internal systems.
What AuthSpoke is not replacing
AuthSpoke does not need to replace AWS Bedrock, Okta, Microsoft Entra, SailPoint or internal IAM. Those systems still matter. AWS runs the agent. IAM governs access. AuthSpoke governs the enterprise AI estate: assets, owners, metadata, lifecycle, policies, findings, reviews and audit evidence.
AuthSpoke lets enterprises adopt AI agents quickly without losing ownership, policy control, audit evidence or accountability.
Why an enterprise spends money on this
Enterprises spend money when a product reduces business risk, accelerates a strategic program or satisfies a required control. AuthSpoke does all three for AI adoption.
For the CIO, it creates a single operating model across AI platforms. For the CISO, it exposes unmanaged AI and connects policy to evidence. For risk and compliance, it creates review history and audit posture. For platform teams, it removes manual inventory work. For AI builders, it gives a path to production that does not depend on ad hoc approvals.
The outcome for Meridian
Meridian can now tell a customer, auditor or board committee: we know which AI agents exist, where they came from, who owns them, what state they are in, which policies apply, what findings are open, what exemptions were approved and what changed over time.
That is the business value behind the functionality. Not more screens. A governed way to run enterprise AI.
Turn AI adoption into governed AI operations
AuthSpoke helps enterprises discover, govern and audit AI agents across providers, identities, policies, findings and automation workflows.