The DataShield blog

Field notes on governing AI agents

An AI agent governance blog with mechanism-level writing from the team building it. How to secure AI agents, prove what they did, and map that to the rules that actually bite. We cite our claims. A few strong opinions, and no fluff.

REGULATED AI AGENTS

Claude Code for Banks and Hospitals

What changes when a Claude Code repo's context touches PHI or cardholder data, and how transcript custody and per-call authorization close the gap.

2026-09-23 MCP AUTHORIZATION

Opaque Token Revocation for MCP

Why immediate revocation needs more than a self-contained JWT, and how a scope-ceiling token with a live re-check kills access mid-session.

2026-09-23 CLAUDE CODE OPERATIONS

Self-Hosted Claude Code Transcript Storage

What Commander keeps from a Claude Code session, how transcript search and retention work, and how erasure is handled.

2026-09-23 HEALTHCARE COMPLIANCE

Business Associate Agreement for AI Agent Vendors

What a BAA has to cover when the vendor runs agents over PHI, what to ask before signing, and how DataShield's own lanes answer it.

2026-09-23 SOC 2 FOR AGENTS

Machine Identity Audit Evidence for SOC 2

The evidence a SOC 2 auditor wants for non-human identities, mapped to CC6 and CC7, and where DataShield's own attestation stands.

2026-09-23 MCP AUTHORIZATION

MCP Catch-All Scopes: Why Per-Tool Permissions Matter

Why MCP servers default to one catch-all OAuth scope, what breaks when an agent inherits it, and the best-practice list for scoping tools one by one.

2026-09-23 SOC 2 FOR AGENTS

The Accountable Human for Autonomous Agent Actions

SOC 2 auditors now ask which human is accountable for an AI agent's action. The attribution gap, CC6/CC7 evidence, and how to close it.

2026-09-23 MCP SECURITY

MCP Tool Schema Drift Detection

What MCP tool schema drift is, why a widened parameter is a widened permission, and how to pin, diff, alert on, and refuse drifted tool schemas.

2026-09-23 AGENT-READY MASTER DATA

Golden Context vs Golden Record for AI Agents

Golden record vs golden context, explained: why AI agents need lineage, quality, consent and freshness, and how an admission gate builds that context.

2026-09-23 CLAUDE CODE OPERATIONS

Claude Code Agent View Alternative, Self-Hosted: When to Graduate

Agent view vs a self-hosted cockpit for Claude Code: when the official screen is enough, and how Commander attaches to its sessions.

2026-09-23 EU AI Act

What EU AI Act Article 12 actually requires you to log

The three log categories, the six-month retention rule, and why a log your admin can quietly edit is worth nothing the moment a regulator tests it.

Jul 2026 Databricks

Unity Catalog vs independent agent governance

Unity AI Gateway tracing is the platform auditing itself. Why tamper-evident evidence should come from a separate witness, and where each fits.

May 2026 AWS

Per-call authorization for Bedrock AgentCore

AgentCore Policy already authorizes per call. The two gaps it leaves, a scope ceiling on delegated tokens and a next-call kill, and how to close them.

May 2026 Microsoft Fabric

Article 12 logging for Microsoft Fabric agents

Purview DSPM for AI captures Fabric Data Agent interactions, but retention is tiered and the log is not tamper-evident. How to build a lifetime, verifiable record.

May 2026 Databricks

Securing a Databricks MCP server for AI agents

Unity grants stay role-scoped with no per-call ceiling and no next-call kill. How to cap a Genie or MCP agent below its role on every call.

Apr 2026 Tokenization

Consistent PII tokens across Snowflake and Databricks

Every native masking control is platform-scoped, so a customer id tokenizes differently in each warehouse and joins break. One customer-held vault fixes it.

Apr 2026 Agent authorization

Break-glass access for AI agents

Standing privilege is a liability. How to give an agent emergency access that is time-boxed, dual-approved, fully audited, and auto-revoked.

Apr 2026 Snowflake

Securing a Snowflake MCP server for AI agents

Snowflake MCP setups default to a long-lived PAT or shared service account. How to cap every call below the granted role and kill a revoked agent on its next call.

Apr 2026 AWS

CloudTrail vs tamper-evident audit for AI agents

CloudTrail chains audit logs at the hourly-file level, not per agent action. What it proves, where it stops, and the independent evidence layer to add.

Apr 2026 MCP security

MCP prompt injection: direct, indirect, and how to defend

You cannot fully prevent it, so contain it. Direct vs indirect injection, the lethal trifecta, EchoLeak and the GitHub MCP flow, and the controls that cap the blast radius.

Mar 2026 Microsoft Fabric

Fabric labels vs tokenizing PII for AI agents

Purview labels classify and gate, but the raw identifier stays in OneLake. Tokenizing at ingest removes it so a Copilot or agent sees tokens, not names.

Mar 2026 MCP security

MCP tool poisoning: how it works and how to stop it

Hidden instructions in a tool description, schema, or output make your agent obey commands you never see. The mechanism, the real incidents, and the defenses.

Mar 2026 Snowflake

Snowflake masking vs tokenizing PII for agents

Horizon masking is role-based and Snowflake-reversible. Tokenizing at ingest removes the identifier from the query path with a vault you hold. When to use which.

Mar 2026 MCP security

MCP server security: the complete threat model

Every MCP attack class, from prompt injection and tool poisoning to rug pulls and SSRF, each paired with the control that stops it. Plus the half most guides skip: governing what the agent can reach.

Feb 2026 Governance

AI agent governance vs gateways vs guardrails

Guardrails filter output, gateways proxy traffic, governance controls what the agent can reach. What each layer catches, what it misses, and why you need all three.

Jan 2026 Standards

OWASP Top 10 for Agentic Applications, explained

All ten ASI categories, from ASI01 Agent Goal Hijack to ASI10 Rogue Agents, the real incidents behind them, and the class of control that addresses each.

Dec 2025 Tokenization

How to tokenize PII before it reaches an LLM

Classify and tokenize sensitive fields at ingest so the agent works on tokens, not raw identifiers. The pattern, the tradeoffs, and why a leak then yields tokens instead of PII.

Nov 2025 Authorization

Per-call vs per-session authorization for AI agents

One broad grant at login versus authorizing every tool call against live policy. Why per-call authorization shrinks the blast radius of a hijacked agent.

Oct 2025

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →