Get an instant quote

The DataShield blog

Field notes on governing AI agents

Mechanism-level writing from the team building agent governance. How to secure AI agents, prove what they did, and map it to the rules that actually bite. Cited claims, a few strong opinions, no fluff.

What the DataShield blog covers The DataShield blog covers six areas of AI agent governance: MCP security (prompt injection, tool poisoning, threat models), agent authorization and non-human identity, audit and evidence including tamper-evident logs and EU AI Act and HIPAA compliance, PII and PHI tokenization, the difference between AI gateways and governance, and controls for regulated industries. WHAT WE COVER MCP security prompt injection, tool poisoning, threat models Agent authorization per-call auth, break-glass, non-human identity Audit & evidence tamper-evident logs, EU AI Act, HIPAA Tokenization PII/PHI de-identification for agents Gateways vs governance what each layer actually does Regulated industries healthcare and financial controls
EU AI Act

What EU AI Act Article 12 actually requires you to log

The three log categories, the six-month retention rule, and why a log your admin can quietly edit is worth nothing the moment a regulator tests it.

Jul 2026 Databricks

Unity Catalog vs independent agent governance

Unity AI Gateway tracing is the platform auditing itself. Why tamper-evident evidence should come from a separate witness, and where each fits.

May 2026 AWS

Per-call authorization for Bedrock AgentCore

AgentCore Policy already authorizes per call. The two gaps it leaves, a scope ceiling on delegated tokens and a next-call kill, and how to close them.

May 2026 Microsoft Fabric

Article 12 logging for Microsoft Fabric agents

Purview DSPM for AI captures Fabric Data Agent interactions, but retention is tiered and the log is not tamper-evident. How to build a lifetime, verifiable record.

May 2026 Databricks

Securing a Databricks MCP server for AI agents

Unity grants stay role-scoped with no per-call ceiling and no next-call kill. How to cap a Genie or MCP agent below its role on every call.

Apr 2026 Tokenization

Consistent PII tokens across Snowflake and Databricks

Every native masking control is platform-scoped, so a customer id tokenizes differently in each warehouse and joins break. One customer-held vault fixes it.

Apr 2026 Agent authorization

Break-glass access for AI agents

Standing privilege is a liability. How to give an agent emergency access that is time-boxed, dual-approved, fully audited, and auto-revoked.

Apr 2026 Snowflake

Securing a Snowflake MCP server for AI agents

Snowflake MCP setups default to a long-lived PAT or shared service account. How to cap every call below the granted role and kill a revoked agent on its next call.

Apr 2026 AWS

CloudTrail vs tamper-evident audit for AI agents

CloudTrail chains audit logs at the hourly-file level, not per agent action. What it proves, where it stops, and the independent evidence layer to add.

Apr 2026 MCP security

MCP prompt injection: direct, indirect, and how to defend

You cannot fully prevent it, so contain it. Direct vs indirect injection, the lethal trifecta, EchoLeak and the GitHub MCP flow, and the controls that cap the blast radius.

Mar 2026 Microsoft Fabric

Fabric labels vs tokenizing PII for AI agents

Purview labels classify and gate, but the raw identifier stays in OneLake. Tokenizing at ingest removes it so a Copilot or agent sees tokens, not names.

Mar 2026 MCP security

MCP tool poisoning: how it works and how to stop it

Hidden instructions in a tool description, schema, or output make your agent obey commands you never see. The mechanism, the real incidents, and the defenses.

Mar 2026 Snowflake

Snowflake masking vs tokenizing PII for agents

Horizon masking is role-based and Snowflake-reversible. Tokenizing at ingest removes the identifier from the query path with a vault you hold. When to use which.

Mar 2026 MCP security

MCP server security: the complete threat model

Every MCP attack class, from prompt injection and tool poisoning to rug pulls and SSRF, paired with the control that actually stops it. Plus the half most guides skip: governing what the agent can reach.

Feb 2026 Governance

AI agent governance vs gateways vs guardrails

Guardrails filter output, gateways proxy traffic, governance controls what the agent can reach. What each layer catches, what it misses, and why you need all three.

Jan 2026 Standards

OWASP Top 10 for Agentic Applications, explained

All ten ASI categories, from ASI01 Agent Goal Hijack to ASI10 Rogue Agents, the real incidents behind them, and the class of control that addresses each.

Dec 2025 Tokenization

How to tokenize PII before it reaches an LLM

Classify and tokenize sensitive fields at ingest so the agent works on tokens, not raw identifiers. The pattern, the tradeoffs, and why a leak then yields tokens instead of PII.

Nov 2025 Authorization

Per-call vs per-session authorization for AI agents

One broad grant at login versus authorizing every tool call against live policy. Why per-call authorization shrinks the blast radius of a hijacked agent.

Oct 2025

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →