AI agent governance
Agents query tokenized data. Every call is proven.
DataShield is the governance layer for provable agent compliance. AI agents in regulated work, with proof you can check. We tokenize PII and PHI at ingest. Auth checks each tool call. You can revoke an agent mid-session. Each call leaves a tamper-evident audit trail. We are an outside vendor. Your firewall company doesn't own us. That is the whole pitch.
- Breached through an AI app? 97% of those firms had no proper AI access controls. - IBM Cost of a Data Breach Report 2025
- A lot of shadow AI adds $670K to the cost of a breach. That's next to low use or none. - IBM Cost of a Data Breach Report 2025
- EU regulators name pseudonymization as a way to cut GDPR risk. - EDPB Opinion 28/2024
- EU AI Act Art. 12 asks for lifetime event logs. Commission fining powers began Aug 2, 2026. - EU AI Act
Provable agent compliance: three mechanisms, one evidence plane
Tokenize: PII tokenization at ingest
We tokenize data at ingest. A value maps to the same token, each time. So your joins hold. The vault can turn the token back. Agents query tokenized data over MCP. Your joins and charts still work. To detokenize you need the right permission. We log the act. Crypto-shred handles erasure. The audit chain lives through it.
Authorize: per-tool-call agent authorization
Every checked tool call runs a real dispatch pipeline. Token scope ceiling, declared authority tier. Then mid-session revocation re-check, metered dispatch. That is per-call authorization. Not a check at login. Break-glass emergency access auto-revokes. No one can quietly drop it from the log.
Prove: a tamper-evident audit trail
A SHA-256 hash chain, with Ed25519-signed checkpoints. The check tells tampering, insertion, deletion and truncation apart. You learn what happened, not just that something changed. Run it yourself. It maps by design to EU AI Act Art. 12/26 and HIPAA §164.312(b).
What happens without MCP security
Real cases, one root cause. Nothing sat between the agent and the data. Asana: a tenant-isolation bug exposed cross-customer data for 34 days. GitHub MCP: prompt injection pulled out private repositories. Supabase MCP: SQL exfiltration through a support ticket. The NSA put out an MCP security advisory. None of it needed a clever attacker.
Not one had per-call authorization. None had tamper-evident logs between agent and data. Gartner's Market Guide for Guardian Agents (2026) expects at least 80% of unauthorized agent transactions through 2028 to be internal policy violations or misguided AI behavior, not malicious attacks. Governance is the control.
Three questions to ask any agent-security vendor
Ask us too. Each answer below names the part that does the work. You can go check it.
Can you cryptographically prove your logs weren't altered?
Ours is a SHA-256 hash chain. The Ed25519-signed checkpoints chain too. A dropped checkpoint shows up. The check tells tampering, insertion, deletion and truncation apart. You don't have to take our word for it. Verify a sample chain yourself. No signup.
What happens to a revoked agent mid-session?
Auth re-checks authority on each checked tool call. Revoke or suspend an agent. Its very next call gets cut down. Not its next login. Not its token expiry. The Asana exposure ran 34 days. Here it would have been one call. See the dispatch flow.
How does GDPR erasure interact with your audit trail?
Crypto-shred handles erasure. We destroy the subject's key. Nobody can work back to the raw person. The audit chain still verifies. That's because actor identities carry HMAC commitments, not names. Your proof survives it. Consent receipts follow ISO 27560.
The independent AI agent security layer
Lakera went to Check Point. Portkey went to Palo Alto. Prompt Security went to SentinelOne. CalypsoAI went to F5. The outside layer is vanishing into platform vendors.
DataShield runs next to your Entra or Okta identity. Also your LiteLLM or Kong gateway, and your detection layer. We are the proof and data layer. The one they all assume someone else brings. And we are not for sale to your firewall vendor.
Agent identity is solved upstream. Authorization evidence is ours.
Bring your own IdP. Entra or Okta says who the agent is. DataShield proves the agent had permission to do it.
Provable agent compliance is the part no one upstream solves. Not who the agent is. Whether Auth allowed each call. And proof no one edited the record afterwards.
Video by Microsoft Mechanics. DataShield federates to your IdP over SAML/OIDC. Then it adds the authorization and proof layers.
The stack
Auth
Authorization and evidence for AI agents. It brings scope-ceiling MCP tool tokens and break-glass. Plus a hash-chained audit. v2.4.1, live now. Explore Auth
Ontology
The governed data plane. It holds PII/PHI classification and tokenization at ingest. Quasi-identifier generalization lives there too. Agents reach the DataShield Analytical DB over MCP. v2.2.0, live now. Explore Ontology
Commander
The cockpit for coding agents. Run many Claude Code sessions per project. Personas boot them from governed prompts. Ship up a dev-to-test-to-prod promotion ladder. It carries an audited override. v3.0.15, live now. Explore Commander
Corpus
Docs, agent definitions and skills. Served to agents over MCP. Vendor, customer and copy catalogs stack in layers. Drift checks watch them. Auth meters and hash-chains each request. v1.3.2, live now. Explore Corpus
Corpus has shipped. It's the agent MCP server for docs, agents and skills. Read about it.
Built for regulated deployments
- Self-hosted or dedicated single-tenant: your own kit, your own keys held on your instance.
- BAA conversation welcome: health care is why the data plane exists.
- Design-partner program: with a source-escrow option.
- Honest limitations: we post them on the architecture page. You won't find them during your trial.
Get a scoped quote in minutes. An agent governed by this very stack quotes it.
Get an instant quoteYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →