> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mergeguide.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What is AI code governance?

> AI velocity, enterprise governance: govern AI-written and human-written code in one place, without leaving your workflow.

**AI code governance** is the practice of keeping policy, security, and compliance
control over code as your team's velocity increases — including the growing share
of code that AI assistants help write.

MergeGuide's promise is simple: **AI velocity, enterprise governance.** Embrace AI
speed without sacrificing control. Governance runs where developers already work,
so it accelerates the path to a clean, shippable change rather than adding a
separate gate that slows everyone down.

<Note>
  This page explains the user-facing concept. It is not a description of how
  MergeGuide's detection works internally — see the how-to and reference sections
  for what you actually do with the product.
</Note>

## Why a governance layer for AI-era code

Two things changed at the same time:

1. **More code, faster.** AI assistants generate large amounts of code quickly.
   Review capacity did not grow at the same rate.
2. **Higher stakes.** Security and compliance expectations (SOC 2, ISO 27001,
   PCI DSS, the emerging AI regulations) keep rising, and auditors increasingly
   ask how you govern AI-assisted development specifically.

Without a governance layer, teams face a false choice: slow down to stay in
control, or move fast and lose it. MergeGuide removes that trade-off by applying
the *same* policies consistently at every point in the workflow.

## What MergeGuide governs

MergeGuide checks both AI-written and human-written code against the policies and
compliance frameworks your organization selects. You decide what "good" means;
MergeGuide enforces it consistently and shows developers what to fix.

* **Policies** — the rules your code must satisfy (for example, "no hardcoded
  secrets"). You select which apply at the org, project, group, or repo level.
* **Compliance frameworks** — named standards (such as SOC 2 or ISO 27001) that
  map to sets of controls. Activating a framework scopes the checks that run.
* **Findings** — what MergeGuide reports when code doesn't satisfy a policy, with
  the file, line, severity, and guidance on how to fix it.

For precise definitions of these terms, see [Core concepts](/get-started/core-concepts).

## Governance that meets developers where they work

The same governance is applied at several points in your workflow, so problems are
caught at the earliest, cheapest moment:

<CardGroup cols={2}>
  <Card title="In your IDE" icon="code">
    The extension surfaces findings as you edit, before you commit.
  </Card>

  <Card title="In your AI assistant" icon="robot">
    The MCP server lets AI coding tools check a change against your policies as
    part of the loop.
  </Card>

  <Card title="On local commits" icon="code-commit">
    Git hooks check staged changes before they leave your machine.
  </Card>

  <Card title="On pull requests" icon="code-pull-request">
    The PR gate evaluates each PR on GitHub, GitLab, Bitbucket, or Azure DevOps
    and reports inline.
  </Card>
</CardGroup>

This is not "more gates." It is the *same* governance, applied earlier. A finding
you resolve in the IDE never has to be caught again at the PR — that is what lets
you keep AI velocity without giving up control.

## Where to go next

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/get-started/quickstart">
    Install, authenticate, and run your first check.
  </Card>

  <Card title="Core concepts" icon="book" href="/get-started/core-concepts">
    Policies, frameworks, findings, severity, and enforcement layers.
  </Card>
</CardGroup>