--- title: "Token Observe versus cloud-native controls" canonical_url: "https://tokenobserve.com/compare/cloud-native-controls" published: 2026-09-02 last_updated: 2026-10-21 --- # Token Observe versus cloud-native controls If every agent, model and tool lives in one cloud, use that cloud’s controls. The argument here is for the estate that does not. ## The comparison If your agents, your models and your tools all live inside one cloud, that cloud’s own controls are the better choice and this page will not argue otherwise. On each provider’s own published material, untested here: AWS describes Cedar-based runtime authorisation for the Bedrock AgentCore Gateway; Microsoft describes Entra Agent ID and Agent 365 as putting agent identity, sponsors and lifecycle in the directory that already governs your people; Google publishes agent IAM and runtime defence. Token Observe is for the estate that is not on one cloud: six first-class upstreams under one set of permissions, policies, redaction, budgets and tracing, with equivalence enforced by a table-driven test over every provider kind. It does not replace your identity provider and the roadmap forbids trying. The one claim it makes that a single-cloud control cannot is cross-provider equivalence plus one evidence chain spanning all of them. ## Named products in this category - Amazon Bedrock AgentCore (Cedar authorisation) - Microsoft Entra Agent ID - Microsoft Agent 365 - Google agent IAM ## Facts - Providers under one policy set: OpenAI, Anthropic, Gemini, OpenRouter, Bedrock, Azure OpenAI - Equivalence mechanism: A table-driven parity test over every provider kind - Identity posture: Federate your OIDC provider; never replace it - Policy export: Digest-locked OPA Rego with positive and negative witnesses ## The limit Cedar is a future target: Only OPA Rego ships, and scope and trigger matching only ## Where they win: Inside one cloud, the native control is closer, cheaper and better attested. A control inside the provider’s own runtime has advantages no external proxy can match. There is no extra hop and no extra process to operate; the decision happens in the same trust boundary as the workload; identity, key management and audit are the ones you already run; and it arrives under the certifications that provider publishes, which Token Observe holds none of. If your agents call Bedrock models through an AgentCore gateway and nothing else, a second control plane buys a second failure domain in exchange for portability you are not using. Microsoft is stronger still on identity, and this product’s market analysis says so: the recorded consequence is to federate Entra and Agent 365, not to rebuild them. The third advantage is direction of travel — generic gateway and policy features are being bundled by the hyperscalers, and a buyer whose estate the bundle already covers should take the bundle. Cloud AI features change preview status quickly, so verify availability and policy semantics with the provider during procurement rather than from a comparison page. ## The difference, dimension by dimension ### Policy equivalence Them: Policy expressed in that cloud’s language, enforced by that cloud. Token Observe: One policy set, with equivalence enforced by a table-driven test over every provider kind. ### Identity Them: Authoritative. The directory is the source of truth. Token Observe: Federated. OIDC sign-in, directory groups mapped to roles, taken as a snapshot with a 24-hour default staleness, not a live directory read. ### Data residency Them: The residency and sovereignty commitments that provider publishes and contracts for. Token Observe: Three independent flags — retention, training, region — checked on every fallback. Nothing verifies a provider’s claim; a Bedrock region binding proves configuration consistency, not residency. ### The evidence trail Them: That cloud’s audit log, inside that cloud. Token Observe: One hash-chained audit log across every provider, anchored off-box with Ed25519. Tamper-evident, not tamper-proof. ### Independent assurance Them: The certifications and regional attestations that provider publishes. Token Observe: None. No SOC 2, no ISO 27001, no ISO 42001, no independent penetration test — stated first, not on request. ### Apply your data policy across providers. One agent can be routed across OpenAI, Anthropic, Google Gemini, OpenRouter, Amazon Bedrock and Azure OpenAI, and the same permissions, policies, redaction, budgets and tracing apply whichever one serves the request. That equivalence is enforced by a table-driven test over every provider kind. Carry this into any evaluation of a multi-provider control: a policy that fires on OpenAI but not on Gemini is worse than no policy, because it produces a governance report describing coverage you do not have. Routing carries the same discipline into failover. Every fallback candidate is filtered through the agent’s data policy first, so failing over cannot bypass a zero-retention, no-training or region constraint, and failover is typed rather than counted: a timeout, a 429 or a 5xx moves on, while a content-policy refusal, an authentication failure and a malformed request stop. Otherwise the chain launders a refusal into a success. ### What Token Observe chooses not to rebuild. Two of the seven strategic non-goals are about this category: do not build a replacement enterprise identity provider or credential vault, and do not build a broad CMDB-style AI inventory. Implement adapters and evidence exchange for those layers instead. So the identity surface is short — OIDC sign-in, directory groups mapped to roles, bounded SCIM provisioning — and the registry is a system of record for governed agents rather than an estate-wide inventory. It does not discover agents for you. - What federation means here: OIDC sign-in for console users, directory groups mapped to roles, and an optional on-behalf-of mask that intersects a named human’s authority with the agent’s. The mask can only narrow, never grant. - The staleness you are accepting: Group claims are a snapshot taken at sign-in, aged out on a 24-hour default window. A revoked group keeps granting until the next sign-in or that expiry, and that residual risk requires the CISO’s written acceptance. - What region binding proves: A declared Bedrock policy region is bound to the region proven by an AWS-owned runtime endpoint, and contradictions fail closed. That proves configuration consistency, not data residency and not your network path. ## Choose the alternative when - Every agent, model and tool you govern is inside one cloud, and portability is a cost rather than a requirement. - Your control has to inherit that cloud’s certifications, regional attestations or FedRAMP posture. Token Observe holds no independent certification of any kind. - Identity is the requirement rather than action assurance: agent identity, sponsorship, lifecycle and Conditional Access belong in the directory that already governs your people. - You need the enforcement point inside the workload’s own trust boundary, with no external process to run and no second failure domain. ## Choose Token Observe when - You run more than one model provider (or one cloud plus one frontier lab), and the same rule now has to bind identically on all of them. - You need one evidence chain that spans providers, rather than one audit log per cloud and a spreadsheet reconciling them. - A data-policy constraint has to survive failover, so a fallback that silently routes around a no-training or region requirement is unacceptable. - Self-hosting in your own network is a requirement, including an air-gapped environment, which the licence is drafted to permit. ## Questions and answers Q: Does Token Observe replace Entra or our identity provider? A: No, and a replacement enterprise identity provider or credential vault is one of the seven strategic non-goals. Console sign-in federates your OIDC provider, directory groups map to roles, and bounded SCIM provisioning handles viewer lifecycle; that is the whole identity surface, and it attaches authority and effect evidence to identities your directory already owns. The recorded consequence for Microsoft is to federate Agent 365 identities rather than rebuild Entra. Q: Can Token Observe policies be compiled to Cedar for AgentCore? A: Not today. The shipped compiler target is OPA Rego, emitting digest-locked policy and data with reproducible witnesses for scope and trigger matching, and it refuses to translate tool-argument matchers rather than weakening their semantics. AWS AgentCore and Cedar are named as a future target. Even for the target that exists, the artifact excludes permissions, budgets, approval consumption, kill switches, action precedence and side effects; Token Observe stays authoritative for those. Q: Can Token Observe prove our data stayed in a region? A: No. An agent carries three independent data-policy flags (zero retention, no training, a serving region), and every routing candidate including every fallback is filtered through them. What that enforces is your configuration. Nothing verifies a provider’s own claim: those flags are unverified operator assertions, and that residual risk has a named acceptor on the register. The strongest thing available is the Bedrock region binding, which fails closed on a contradiction — configuration consistency, not data residency.