Drshta Governance
The reviewer console for governed AI actions.
Drshta Governance sits between AI agents and the systems they change. Reviewers see what an agent proposes, the evidence behind it and the policy result, then approve or reject on the record.
A0A2 Ran at A0 and A2 on live ServiceNow data for a fictional bank.
How it works
One path for every decision, from proposal to proof.
-
Propose
An agent proposes
Agents analyse your systems of record, raise findings and propose corrective actions, each with the evidence behind it.
-
Evaluate
Policy is checked
Each proposal is tested against the policy controls mapped to your frameworks, and the result is kept as a policy decision.
-
Approval gate
A person decides
Actions above the risk tier wait for a named reviewer, who approves or rejects with a recorded rationale.
-
Record
Evidence is sealed
The decision, its evidence and the approval go into a hash-chained ledger with Merkle proofs, the source for each signed receipt.
In the console
Findings and investigation
Every finding carries its severity, the controls it affects and its history across review cycles.
Framework coverage
Control-level coverage across the frameworks you report against, derived from policy rules linked to OSCAL controls.
Reviewer decisions
Approvals and rejections with reviewer identity, timestamp and rationale, kept as governed records.
Evidence trail
Trace any finding to its control, the supporting evidence and the sign-off, then export the tamper-evident audit package for the run.
Time to Compliance
A projected compliance date with a confidence range, forecast from your own governed history.
Grounded copilot
Ask about a run in plain language. Every answer cites the run’s evidence, and the record stays read-only to the copilot.
Frameworks
Findings and controls map to the frameworks regulated teams already report against.
| Framework | Edition | Scope |
|---|---|---|
| NIST SP 800-53 | Rev. 5 | Security and privacy controls |
| ISO/IEC 27001 | 2022, Annex A | Information security management |
| SOC 2 | TSC 2017 | Trust Services Criteria for service organizations |
| NIST AI RMF | 1.0 | AI risk management, Govern and Map functions |
| BCBS 239 | 2013 | Risk data aggregation and reporting for banks |
Drshta maps evidence to framework controls in support of your compliance program. Certification stays with your auditor.
Architecture
AI advises. The record decides.
The system of record is deterministic and contains no language model. AI components read and explain the evidence through a controlled gateway that audits every call; changes reach the record only through the policy and approval path.
Portable by design
Runs on Postgres and any KMS, and is designed to register receipts with any SCITT transparency service.
Reference deployment on AWS, 2026:
- Amazon ECS on Fargate
- Amazon Aurora PostgreSQL
- Amazon S3
- AWS KMS
- Amazon Bedrock
- AWS WAF
See a complete governance cycle.
The demo walks through seven review cycles for a fictional bank at A0 and A2: findings, evidence, reviewer decisions and the audit export.