Token Observe vs cloud-native controls
If every agent, model and tool lives in one cloud, use that cloud’s controls. The argument here is for the estate that does not.
Amazon Bedrock AgentCore (Cedar authorisation), Microsoft Entra Agent ID, Microsoft Agent 365, Google agent IAM. Every claim about them on this page is that vendor's own published material, untested by us.
the other comparisonsOn this page
Inside one cloud, the native control is closer, cheaper and better attested
A control that lives inside the provider’s own runtime has advantages no external proxy can match. There is no extra hop and no extra process for your team to operate; the policy decision happens in the same trust boundary as the workload, so there is no window in which a request exists outside both; identity, key management, audit and organisational guardrails are the ones you already run; and the whole thing arrives under the certifications and regional attestations that provider publishes, which Token Observe holds none of. If your agents call Bedrock models through an AgentCore gateway and nothing else, adding a second control plane buys you a second failure domain in exchange for portability you are not using.
Microsoft’s position is stronger still on the identity half, and the product’s own market analysis says so rather than arguing with it: Entra Agent ID and Agent 365 are described as bringing cross-platform registry, agent identity blueprints, sponsors, lifecycle, governance templates, Conditional Access and Defender and Purview integration, and the recorded consequence is to federate those identities and inventory and not to rebuild Entra or a Microsoft-scale control tower. Token Observe’s own identity story is deliberately smaller: it federates an OIDC provider, maps directory groups to roles, and takes those group claims as a snapshot with a default staleness of 24 hours rather than reading the directory live — a limit accepted on the record, because following a directory API would mean a new credential, a new egress host, a directory-read permission and a network dependency inside a login, all wrong for a product that ships air-gapped.
The third advantage is direction of travel, and the product’s own market analysis records it as pressure on itself rather than as an opening: generic gateway and policy features are being bundled by the hyperscalers, and the ground left to a separate product narrows every quarter. The honest reading of that is that a buyer whose estate the bundle already covers should take the bundle, and should expect it to cover more next year than it does today. Every description of a cloud provider’s product on this page is drawn from public, vendor-authored material and has not been independently tested; verify preview status, regional availability and exact policy semantics with the provider during procurement rather than from a comparison page.
Token Observe and cloud-native controls, row by row
One card per dimension rather than a three-column table, because the two sides are rarely the same length and a table of them is a horizontal scroller on a phone.
Agents, models and tools inside that provider’s runtime.
Anything that presents a credential to the gateway, across six first-class upstreams plus any OpenAI-compatible endpoint you register.
Policy expressed in that cloud’s language, enforced by that cloud.
One policy set, with cross-provider equivalence enforced by a table-driven test over every provider kind rather than asserted.
Authoritative. The directory is the source of truth.
Federated. OIDC sign-in, directory groups mapped to roles, taken as a snapshot with a 24-hour default staleness — not a live directory read.
The residency and sovereignty commitments that provider publishes and contracts for.
Three independent flags — retention, training, region — checked on every fallback. Nothing verifies a provider’s claim; a declared Bedrock region is bound to a region proven by an AWS-owned runtime endpoint, which proves configuration consistency and not residency.
That cloud’s audit log, inside that cloud.
One hash-chained audit log across every provider, anchored off-box with Ed25519 to a sink you site outside the database administrator’s control. Tamper-evident, not tamper-proof.
The certifications and regional attestations that provider publishes — check the scope and date of each.
None. No SOC 2, no ISO 27001, no ISO 42001, no independent penetration test — stated first, not on request.
Cross-provider equivalence is the entire claim, so here is the mechanism
One agent can be routed across OpenAI, Anthropic, Google Gemini, OpenRouter, Amazon Bedrock and Azure OpenAI, and the same permissions, policies, redaction, budgets and tracing apply whichever one serves the request. That equivalence is not an aspiration in the documentation; it is enforced by a table-driven test that runs over every provider kind, and the reason given for spending the effort is the sentence a buyer should carry into any evaluation of a multi-provider control: a policy that fires on OpenAI but not on Gemini is worse than no policy, because it produces a governance report that describes coverage you do not have.
Routing carries the same discipline into failover. A route rule names a primary target and an ordered fallback chain, every candidate in that chain is filtered through the agent’s data policy before it can be used, so failing over cannot bypass a zero-retention, no-training or region constraint, and failover itself is typed rather than counted: a timeout, a 429 or a 5xx moves to the next provider, while a content-policy refusal, an authentication failure, an over-long context and a malformed request all stop where they are. Otherwise the fallback chain quietly launders a refusal into a success, which in a multi-cloud estate is exactly the failure that survives review, because the report says the request succeeded.
After the call, the route is narrowed to whichever provider actually served it, so the ledger prices against the vendor that will invoice you rather than the one that was tried first. That matters more in a mixed estate than in a single-cloud one, and it is the sort of detail that decides whether a cost report can be reconciled against six invoices or only argued with.
What Token Observe deliberately does not rebuild
Two of the seven strategic non-goals are directly about this category: do not build a replacement enterprise identity provider or credential vault, and do not build a broad CMDB-style AI inventory competing with Microsoft or ServiceNow. The instruction that follows them is to implement adapters and evidence exchange for those layers instead, and the market analysis is explicit that first-class workload identity, short-lived audience-bound credentials, human-to-agent delegation and lifecycle reviews are table stakes rather than a moat.
So the honest description of Token Observe’s identity surface is a short one. Sign-in federates an OIDC provider, with bounded SCIM user provisioning alongside it that accepts lifecycle for viewer accounts, permits disable but not rename or reactivation once an account holds more authority, and revokes sessions on disable — and deliberately omits hard delete, groups, bulk operations, passwords and extension schemas. Agent credentials are long-lived hashed bearer tokens, an accepted decision rather than an unnoticed one, because workload identity in the SPIFFE sense cannot be presented by the agent frameworks the product must support today; revocation and expiry compensate, and a workload identity exchange producing short audience-scoped capabilities exists behind configuration for the frameworks that can.
The registry is a system of record for governed agents rather than an estate-wide inventory. It does not discover agents for you: registering one is a deliberate act by a named person, and anything calling a model without a record is the radar’s problem rather than the registry’s. Where an authoritative upstream inventory exists — Entra, Agent 365, a CMDB — the intended shape is to attach authority and effect evidence to those assets rather than to hold a competing list.
- What federation means here
- OIDC sign-in for console users, directory groups mapped to roles, and an optional on-behalf-of mask that intersects a named human’s mapped authority with the agent’s. The mask can only narrow, never grant, so a forged principal buys an attacker strictly less than sending no header at all.
- The staleness you are accepting
- Group claims are a snapshot taken at sign-in and aged out on a configurable window with a 24-hour default. A revoked group keeps granting until the next sign-in or that expiry, and that residual risk requires the CISO’s written acceptance.
- Region binding, precisely
- A declared Bedrock policy region is bound to the region proven by an AWS-owned runtime endpoint, and signing must use that same region; contradictions fail closed. That proves configuration consistency, not AWS data residency and not your network path. A custom endpoint with no verifiable regional mapping cannot make the residency claim at all.
Proving a policy means the same thing somewhere else, and what that proof excludes
The cross-control-plane compiler exists because a multi-cloud estate ends up with more than one enforcement point, and a translated policy that quietly means something weaker is worse than no translation. The shipped target is OPA Rego: the compiler emits digest-locked Rego and data alongside reproducible positive and negative witnesses for scope and trigger matching, records the compiler, source-policy and target-policy digests, and lists every source policy it rejected. It refuses to translate tool-argument matchers rather than turning JavaScript value and regular-expression behaviour into weaker Rego semantics, which is the design decision the whole feature rests on — the product is not configuration generation, it is evidence that the generated policy preserves the source meaning.
The exclusions are as important as the output and are published on the endpoint that produces it. The artifact covers policy scope and trigger matching only. It does not cover permissions, budgets, approval consumption, kill switches, action precedence or side effects, and Token Observe remains authoritative for all of those. Anyone reading a generated Rego bundle as a complete transfer of governance to another engine is reading it wrong, and the documentation says so at the point of use.
AWS AgentCore and Cedar are named as a future compiler target rather than a shipped one, alongside MCP and gateway targets, cloud IAM and sandbox egress. The definition of done for the broader feature is that at least one external target passes a published equivalence suite, that unsupported semantics cannot silently compile to allow, and that a mutated target policy is detected and linked back to the affected source decision. Until a target meets that bar it is roadmap, and this page will not describe it as anything else.
Which of the two you should actually put in.
Both columns are real answers and both are the same length on the page. Read the left one first: if it describes your estate, it is the cheaper decision and this page has done its job.
When to choose cloud-native controls
- Every agent, model and tool you govern is inside one cloud, and portability is a cost rather than a requirement.
- Your control has to inherit that cloud’s certifications, regional attestations or FedRAMP posture — Token Observe holds no independent certification of any kind.
- Identity is the requirement rather than action assurance: agent identity, sponsorship, lifecycle and Conditional Access belong in the directory that already governs your people.
- You need the enforcement point inside the workload’s own trust boundary, with no external process to run and no second failure domain.
When to choose Token Observe
- You run more than one model provider — or one cloud plus one frontier lab — and the same rule now has to bind identically on all of them.
- You need one evidence chain that spans providers, rather than one audit log per cloud and a spreadsheet reconciling them.
- A data-policy constraint has to survive failover, so a fallback that silently routes around a no-training or region requirement is unacceptable.
- Self-hosting in your own network — including an air-gapped environment, which the licence is drafted to permit, though it remains a template pending counsel — is a requirement rather than a preference.
If the left-hand column is the one that describes you, that is still worth an email: a straight answer about which of these to buy costs both of us less than an evaluation that ends in the same place.
Ask which one fitsThe 4 named products in this category
This page argues about the category. If you have already shortlisted a product, these go head to head with it — every claim about the other product paraphrased from that vendor's own published material on a stated date, and none of it independently tested.
Amazon Bedrock AgentCore
AgentCore enforces Cedar at its own gateway boundary. Token Observe enforces one rule set across six providers from a process you run. The estate decides which you want.
Microsoft Entra Agent ID
Entra decides which identity the agent holds and whether it may be issued a token. Token Observe decides the individual call that token does not cover.
Microsoft Agent 365
Agent 365 governs the agent as an identity in your tenant. Token Observe governs the payload that agent sends to a model provider.
ServiceNow AI Control Tower
AI Control Tower governs an AI asset through a lifecycle. Token Observe governs one request before it leaves your network.
The other comparisons
Same template, same order, same concession first. Claims about every named product on all of them are that vendor's own and have not been independently tested.
Token Observe vs LLM gateways
Token Observe is a gateway in delivery. The gateway is how it arrives, not what it is for.
Token Observe vs LLM observability
One refuses the call inline. The other scores it afterwards. Most estates need both, and they are not substitutes.
Token Observe vs AI security platforms
Token Observe is not a complete AI security suite, and the product’s own strategy document forbids selling it as one.
Token Observe vs building it yourself
For a small estate, a few hundred lines of proxy is usually the right answer. The cost arrives later, and it arrives in specific places.
Token Observe vs doing nothing
With three agents, no regulated data and no incident, doing nothing is often the correct decision. This page is about what changes it.
Does Token Observe replace Entra or our identity provider?
No, and a replacement enterprise identity provider or credential vault is one of the product’s seven strategic non-goals. Console sign-in federates your OIDC provider, directory groups map to roles, and bounded SCIM user provisioning handles viewer lifecycle; that is the whole identity surface, and it is intended to attach authority and effect evidence to the identities your directory already owns. The recorded consequence for Microsoft specifically is to federate Agent 365 identities and inventory and not to rebuild Entra or a Microsoft-scale control tower.
Can Token Observe policies be compiled to Cedar for AgentCore?
Not today. The shipped compiler target is OPA Rego, emitting digest-locked policy and data with reproducible positive and negative witnesses for scope and trigger matching, and it refuses to translate tool-argument matchers rather than weakening their semantics. AWS AgentCore and Cedar are named as a future target alongside MCP, cloud IAM and sandbox egress. Even for the target that exists, the artifact excludes permissions, budgets, approval consumption, kill switches, action precedence and side effects — Token Observe stays authoritative for those, and the endpoint documentation says so where you would encounter it.
How is cross-provider equivalence actually verified?
By a table-driven test that runs the same policy expectations over every provider kind, rather than by assertion in a document. The same permissions, policies, redaction, budgets and tracing apply whichever of the six first-class upstreams serves a request, and each provider’s usage is normalised into mutually exclusive token buckets before any cost arithmetic, because providers genuinely disagree about whether cached tokens sit inside or outside the input total. The stated reason for the investment is that a policy that fires on OpenAI but not on Gemini is worse than no policy. Provider and protocol dialects are also parity-tested against what the upstream actually receives, not against what the request looked like on the way in.
Can Token Observe prove our data stayed in a region?
No, and the wording matters. An agent carries three independent data-policy flags — require zero retention, require no training, require a serving region — and every routing candidate including every fallback is filtered through them before it can be used. What that enforces is your configuration. Nothing verifies a provider’s own claim: provider data-policy flags are unverified operator assertions, and that residual risk has a named acceptor on the register. The strongest thing available is the Bedrock region binding, which ties a declared policy region to a region proven by an AWS-owned runtime endpoint and fails closed on a contradiction — configuration consistency, not data residency, and not your network path.
Are the descriptions of AgentCore, Entra and Google IAM on this page verified?
No. They come from those vendors’ public documentation and product announcements, have not been independently tested, and cloud AI features move and change preview status quickly. The product’s own market benchmark carries the same caveat about its competitive table and adds that the list names the most relevant category leaders rather than every occupant of the category. Verify preview status, regional availability and exact policy semantics with the provider during procurement.
Tell us which way you are leaning, and why.
Write to hello@tenhaw.com with what your agents do, which providers they call and what would have to be true for you to put something in front of them. James Rooney replies. You will get a straight answer about whether Token Observe fits, including when it does not.
no form · no qualification step · no sales desk · the other three ways in