Head-to-head · updated 13 September 2026

DataShield vs Bedrock AgentCore: who proves the tool call was allowed?

Let's start with the part some vendors get wrong. Fair's fair. Bedrock AgentCore really does authorize each tool call. AgentCore Policy went GA on 3 March 2026. The Gateway checks a Cedar decision. Against the JWT claims. It checks the tool's own inputs, too. That happens before the tool runs, every time. Already build on AWS? It's a good agent platform. The CloudWatch dashboards sit right where your team expects them.

We sell the layer underneath that decision. We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back into real data: that's privileged. It's audited, always. Each checked call gets a scope ceiling. Plus an access tier and a live revocation check. Then it lands in a hash chain. You can verify it yourself, without trusting us. Most teams should run both. Really. Here is where each one earns its keep. Sources included.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Someone will one day ask you to prove an agent's access log wasn't edited. CloudWatch can answer what happened. It's good at that. It can't answer that. Run the verifier.
You need to pull an agent's access mid-session. The next tool call should fail. AgentCore sessions can run eight hours. That's a long time to wait for a token to expire.
Your agents touch PHI or regulated PII, and you'd rather they used tokens than raw fields. See how the ontology maps it.
Part of the estate isn't on AWS. Ours runs on your own infrastructure, on your tin, with your keys.

Pick Bedrock AgentCore when

You're an AWS shop and want the whole agent platform on one bill, no less: Runtime, Memory, Gateway, Browser, Code Interpreter, Evaluations, Agent Registry.
You want policies written in plain English that compile to Cedar. A risk manager can read them, then. No policy language to learn.
You need temporal rules over a session. Pass a policy session id. Cedar can judge the whole chain of actions, not just the call in front of it. We don't do that yet.
Your policies need to gate on argument values. AgentCore's own example denies a refund over $500 straight from the tool input.

Bottom line: AgentCore governs the pipe. DataShield governs the data. It keeps the proof, too. Do your agents live on AWS? Run both. Point AgentCore Gateway at our MCP surface. Let each layer do its job.

Feature by feature

Competitor cells describe what AWS's public site says. Docs too. We use the date above. If we got something wrong, email support@myorg.ai. We'll fix it and credit you.

What matters	DataShield	Bedrock AgentCore	Edge
Audit evidence	A SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints are chained, too. Verification names the exact failure. Tampering. Insertion. Deletion. Or truncation. Try the verifier.	Observability writes spans, logs, and metrics to CloudWatch. It uses OpenTelemetry format. Built for tracing. Built for debugging. We found no public tamper evidence.	◆
Agent authorization	Each checked tool call passes a scope ceiling. It also passes a declared access tier. Plus a revocation re-check. That happens before dispatch. Cedar covers admin, config, and token decisions.	AgentCore Policy checks a Cedar decision at the Gateway. That happens on each agent-to-tool request. It uses JWT claims and the tool inputs. Default deny. GA since March 2026.	◈
Mid-session revocation	Revoke or suspend an agent. The very next checked call fails. No waiting for expiry.	Policy can deny a call. But we found no way to kill a token. Not once it's issued. Not before it expires. Sessions run up to eight hours.	◆
Scope ceiling on delegated tokens	Auth-issued MCP tool tokens carry a ceiling. The delegated token can't exceed it. Not even when the upstream authorization server granted more.	Identity vaults refresh tokens. They handle OAuth, on behalf of a user. Nothing documented shrinks a granted token. Not below what the issuer allowed.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes on its own. It can't be quietly deleted from the log.	Not described in the docs we read.	◆
GDPR erasure	Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. Actor IDs carry HMAC commitments. The chain still verifies after erasure.	Standard AWS data deletion and retention controls. How erasure hits agent audit history isn't documented.	◆
Sensitive data handling	We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back into real data: that's privileged. It's audited, always. We also classify PII and PHI. We generalize quasi-identifiers, too. Dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs, and emails get partial masking. Each column gets a measured cardinality-reduction score.	Bedrock Guardrails masks PII in prompts and model responses. But AWS documents a gap. It does not check tool call inputs. Not tool results, or tool definitions. See the FAQ.	◆
Policy authoring	Cedar policies, with policy_explain and entitlement expansion. Written by an engineer.	Natural language authoring compiles to Cedar. Plus temporal rules. They judge a session's whole action chain. Nice work. We don't match it.	◇
Agent platform breadth	We're not a runtime, ourselves. Bring your own agents and frameworks. We govern the data and the calls.	Runtime, Memory, Browser, Code Interpreter, Web Search. Plus Evaluations, Optimization, Agent Registry, and wallet-backed Payments.	◇
MCP and agents	Native MCP endpoints sit on Auth, Ontology, and Lighthouse. MCP tool tokens carry scope ceilings. Per-call metering ties right back to the agent.	Gateway fronts MCP servers and REST tools. It indexes them. It routes agent traffic. Strong MCP support.	◈
Deployment	Self-hosted or dedicated single-tenant. Any cloud or none. Your keys.	AWS only. Framework-neutral and model-neutral, but cloud-locked. Thirteen regions for Policy. Nine for the GA launch, itself.	◆
Maturity signals	Auth, Guardian, and Lighthouse are all live in production. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so.	AWS. GA since 13 October 2025. Cox Automotive, Druva, and Thomson Reuters: all on the record. Every compliance programme you can name, basically.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Listed per-unit rates. Policy costs $0.000025 per authorization request. Gateway costs $0.005 per 1,000 API invocations. Cheap. Visible without a call.	◈

◆ DataShield leads◇ Bedrock AgentCore leads◈ comparable

AgentCore claims come from aws.amazon.com. Plus AWS documentation. Last checked on 13 September 2026. We link them below. Not just a paraphrase from memory.

Three things you get here that you won't get from an agent platform

Proof, not telemetry

A trace tells your on-call engineer what the agent did. Fine, so far. It doesn't tell a regulator that nobody edited the record. Not on its own. Not afterward. Ours is a hash chain with signed checkpoints. The verifier names what went wrong. That's the property EU AI Act Article 12 reviewers care about. Most of all. Same for HIPAA §164.312(b). Try it in your browser, no signup.

Authority that can change mid-flight

An analyst quits at 2pm. Their agent is 20 minutes into a long job. It's an eight-hour session. Our next checked call re-checks current access, right then. It fails closed. A policy decision alone can't help. Not if the token is still good. Not if the policy still says yes. How Auth does it.

Tokens where the PII used to be

Authorization decides what an agent may do. It says nothing about what the agent can reach. Tokenize the sensitive fields at ingest. Then a hijacked agent finds TOK_ strings. Not patient names. The mapping lives in the ontology. The key custody story is on the security page.

Where Bedrock AgentCore is genuinely stronger

AgentCore is the best-funded agent platform in the market. It shows, clearly. The Gateway fronts your MCP servers. It fronts REST tools, too. It routes agent traffic through one checked door. Policy compiles plain-English rules into Cedar. A risk manager can read them, then. It applies default deny, per request. It can gate on the tool's actual inputs, too. Not just the tool name. Temporal rules go further still. Hand the Gateway a policy session id. Cedar judges the whole chain of actions. In that session. We don't ship that. I'd rather say so. Than pretend the gap runs the other way. Add Runtime, Memory, Evaluations, and an agent registry. Put it on an AWS bill. One your finance team already approves. The pull is obvious.

Here's the push-back, though. All of that governs the request. None of it changes what's in the response. None of it makes the decision record hard to change. It stays soft. Not really. AWS's own Guardrails docs admit a gap. In the sensitive-information filter. It doesn't check PII. Not the kind the model writes. Into tool call inputs. It doesn't check PII in the tool results. Not the ones your application hands back. It doesn't check PII in the tool definitions themselves, either. Their example: an email address. Passed to a file-writing tool, unmasked. Not masked. So the data path stays raw, as is. Unless you fix it at the source. Do that with tokenization. Seal each decision into evidence. Then AgentCore's per-call decision becomes defensible. Two years later, still.

Questions worth asking both of us

These are the questions we'd want answered. If we were buying. Ask them on every vendor call, including ours.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes, it can. Each record commits to the one right before it. Checkpoints get Ed25519-signed and chained. Verification tells deletion apart from truncation and from tampering. Run it at /verify. AgentCore: Observability stores spans, logs, and metrics in CloudWatch. We found no public tamper-evidence method for that data. Ask AWS what stops a log group from being shortened. Or dropped. Ask what you'd show an examiner.

What happens to a revoked agent mid-session?

DataShield re-checks access on each checked tool call. Revocation bites on the very next call. AgentCore does check policy per request, at the Gateway. Edit the policy fast enough, though. Then the next call gets denied. But we found no way to revoke a token. Not once issued. Not before it expires. AgentCore sessions can run eight hours. Ask how long a compromised agent keeps working. After you pull its access.

Does Bedrock Guardrails mask PII inside tool calls?

No. AWS says so plainly. The docs state the filter checks text content only. In tool-use workloads, it skips PII. The model writes it into tool call inputs. It skips PII in tool results. The kind returned to the model. It skips PII in your tool definitions, too. Their own example: an email address. Passed to a file-writing tool. Not masked. That's the gap tokenization at ingest closes. The value the agent handles: never the real one.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material. Then it issues an ISO 27560 consent receipt. Actor identities in the chain carry HMAC commitments. Evidence stays verifiable after the subject is gone. For AgentCore, we found retention controls. Plus deletion controls, at the AWS service level. But nothing says what erasing a person does. Not to agent audit history. Ask whether erasing a subject breaks the record. The one you'd rely on.

If we run both, here's the question. What stops an agent going around DataShield?

The same thing that stops it going around the Gateway. You don't give it another door. Point AgentCore Gateway at our MCP endpoints. Keep credentials for the underlying systems in the Connection Vault. Not in the agent. Network-block direct paths, too. Two enforcement points beat one. They fail in different ways. That's the point.

Does DataShield have SOC 2?

Not yet. We won't imply otherwise, ever. You're comparing a young product from a small team. Against AWS. Weigh that honestly. Auth ships with a public threat model. Plus a verifier anyone can run. Guardian and Lighthouse have run since April 2026. Design-partner terms include source escrow. That way, a small vendor isn't a single point of failure. Not by itself. Details on the security page.

AgentCore's positioning: "The platform for production AI agents. Any framework. Any model. Secure at scale." - aws.amazon.com/bedrock/agentcore, 13 Sep 2026
AgentCore reached GA on 13 October 2025. It has eight-hour execution windows and session isolation. - AWS What's New, 13 Oct 2025
AgentCore Policy hit GA on 3 March 2026. Natural-language policies compile to Cedar. They get checked at the Gateway, before a tool runs. - AWS What's New, 3 Mar 2026
Bedrock Guardrails sensitive-information filters "evaluate text content only". In tool-use workloads, they skip PII. Not in tool call inputs, tool results, or tool definitions. - AWS Bedrock user guide, 13 Sep 2026
AgentCore Observability stores metrics, spans, and logs in Amazon CloudWatch. For tracing and debugging. - AgentCore developer guide, 13 Sep 2026
Listed AgentCore rates: Policy costs $0.000025 per authorization request. Gateway costs $0.005 per 1,000 API invocations. - aws.amazon.com/bedrock/agentcore/pricing, 13 Sep 2026

Other head-to-heads

Gateways

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →