The control layer for AI agents
Reimea Meridian puts voice, service and knowledge agents to work inside your own Azure tenant. Every model call goes through one governed gateway, a named person approves what matters, and every step lands in a tamper-evident audit trail.
Built for health and care, financial services and other regulated operations.
Why now
The question for regulated organisations has moved on from whether to use AI agents. It is now who answers for what an agent did, and whether you can prove it afterwards.
of enterprise software applications are expected to include agentic AI by 2028.
of day-to-day work decisions are expected to be made autonomously by agents by 2028.
of agentic AI projects are expected to be cancelled by the end of 2027, partly because of weak risk controls.
Source: Gartner predictions, June 2025, as reported by SD Times.
The models are not what holds these projects back. What holds them back is identity, policy, approval and evidence. That is the work a CISO, a SIRO or a clinical safety officer has to sign.
Reimea starts there. We build the control layer first, then put agents to work inside it. You can expand what agents do without losing sight of who is accountable.
The control layer
Agents never talk to your systems directly. They go through Reimea, which decides who they act for, which models they may use, what needs a person's approval and what gets recorded.
People sign in with your Microsoft Entra ID. Sign-in is limited to your tenant.
Editions and roles decide which agents and modules each person can use.
Every model call goes one way. On Azure, non-UK providers are refused.
Agents draft captures, suggestions and answers. People check and decide.
Each step is chained to the last, with a copy in your Log Analytics.
How an agent action runs
A call, request or question arrives. The agent captures it against a versioned script.
The agent drafts a capture, suggestion or answer, citing its sources.
Identity, entitlements and model policy are checked at the gateway before anything is used.
A named handler reviews the draft, then accepts, edits or rejects it.
Only then is the handover made, the ticket assigned or the record updated.
The whole path is sealed into the hash-chained audit trail.
The Meridian suite
Each product does one job well, and every one runs through the same identity, gateway, approval and audit. Screens are from Meridian, with customer details removed.
Assurance
Your assurance team will ask what is built and what is not. Here is the answer, in plain terms.
Release 23, recorded in the deployment and design documents.
We list these openly so you can plan around them.
Products
Meridian and Exchange share sign-in and assurance, but never access. A Meridian login does not open an Exchange record.
Voice-led service operations with agents built in: voice and virtual agent, capture and handover, service desk, governed knowledge and operational intelligence, all behind one control layer.
Explore the suiteA shared care record that shows where every item came from, when, and what is missing. Built on FHIR R4 and in development with partners.
Read the design thinkingThe Reimea vision
Trust in agents is earned in stages. Each stage widens what agents may do on their own, and the same control layer stays underneath.
Agents listen, draft and suggest. A person approves every action before it reaches a system.
Agents act on their own inside a policy boundary you set. People handle the exceptions and review samples.
Agents work across teams and organisations, handing work to each other with provenance and consent intact.
Horizons 2 and 3 describe direction, not shipped features. We will publish each capability with its evidence when it is built.
Who it is for
Reimea is designed for organisations whose buyers include a CISO, a SIRO or a clinical safety officer, and who need to answer to a regulator.
Out-of-hours, urgent care and NHS-commissioned services. Voice capture, safe handover and service desks that stand up to DSPT and DCB scrutiny.
Contact centres and operations teams where every decision needs an owner, an audit trail and a model-risk story.
Shared service desks, IT and estates teams that want agents doing the routine work while staying inside one tenant.
Insights
Practical writing for the people who sign off AI in regulated organisations. All insights
The models are ready. Identity, policy, approval and evidence are what decide whether agents reach production.
"Human in the loop" is easy to say. Here is how to design approval that people can sustain and auditors can trust.
A shared record should tell you where each item came from, and what it cannot see. The design thinking behind Reimea Exchange.
Company
Paul has more than 25 years of enterprise technology and leadership experience across investment banking, US healthcare AI and cybersecurity, including roles with Rothschild, NASDAQ, Wells Fargo and IBM.
From 2015 to 2023 he built healthcare technology in the US, co-founding HealthPointe Solutions and serving as its CTO and CISO. Today he combines UK healthcare IT, information governance and security leadership with building Reimea's architecture. He has sat on the side of the table that has to approve these systems, and Reimea is built for the people who sit there.
Questions
It is the set of controls between AI agents and the systems they act on: who the agent acts for, which models it may call, which actions need a person to approve, and a record of everything it did. Reimea Meridian provides that layer for voice, service desk, knowledge and intelligence work.
Agents draft and suggest, and a named person reviews and decides. Every model call goes through one AI gateway. Sign-in is limited to your Microsoft Entra tenant. Every step is written to an append-only, hash-chained audit trail.
Each customer gets a single-tenant deployment in its own Azure resource group in UK South or UK West, with its own managed identity, Key Vault, keys, storage and database.
All model calls go through Meridian's AI gateway, which applies your policy. On Azure, the gateway refuses providers that would process data outside the UK.
Not yet. Clinical modules, including the symptom checker and patient app, are released for clinical use once a clinical safety officer signs off DCB0129 and the customer completes DCB0160.
Meridian runs voice-led service operations and the agents within them. Exchange is a source-attributed shared care record, currently in development. They are separate products, and a Meridian login never gives access to Exchange records.
A 45-minute briefing for your technology, security and governance leads. We cover the control layer, deployment in your tenant and an honest view of what is ready.