Token Observe vs Arize

One environment variable. OPENAI_BASE_URL or ANTHROPIC_BASE_URL points at Token Observe, which then holds the agent credential and the provider credential, so there is no library inside the agent to remove.

Eleven ordered steps to one decision point: authenticate, resolve the agent, open the trace, sanitise Unicode, scan for sensitive data and injection, take the verdict at step 6, enact it, route, call upstream, govern any tool call the model proposes, then meter and record.

One trace per governed request, holding events, normalised usage, policy decisions, redaction outcomes, approvals and tool calls. Application-internal steps that never present a Token Observe credential are not in it.

An input. An OTLP-over-HTTP receiver takes bounded JSON and protobuf for logs, traces and metrics, answers in the request encoding, and attributes every write to the credential that presented it — used as the observed view of a reconciliation, not as a competing backend.

Fail-closed, and deliberately. A boot-time walk of the audit chain that finds corruption latches readiness and audit writes unavailable, governed requests then receive a 503 carrying ACP_AUDIT_UNAVAILABLE, and there is no online clear — recovery means restoring a database whose chain and independently retained head verify.

Detection is built into the hop and is heuristic: eleven sensitive-data classes with Luhn, IBAN mod-97 and NHS mod-11 checksums on three of them, and nine weighted injection patterns scored 1.25× higher when the text is a tool result rather than a prompt.

A typed refusal. The trace closes as blocked, the caller receives ACP_POLICY_BLOCKED, and nothing reached the provider. On a streamed response the plan is fixed before the first byte and a blocking class ends the stream with an in-band frame, because a status line is spent once written.

Published per kind rather than as an aggregate: 0.70 confidence on a phone number, 0.98 on a checksum-valid IBAN, 0.99 on a PEM private key. Free-text personal data is not detected at all, and the product’s own material calls this a compensating control rather than your only DLP.

A 403 carrying an approval id, bound to the SHA-256 of the canonicalised action plus the execution context it was proposed in, single-use by compare-and-set, expiring at 60 minutes by default and configurable from one minute to seven days.

The money verdict is taken after the route resolves and before egress: every provider and fallback the resolved route could execute is priced, the most expensive of those rates is reserved against the agent’s hour, day and month windows in one per-agent transaction, and a budgeted agent whose route has an unpriced reachable target is refused with a 409 rather than metered at zero.

Requests, tool calls and tokens per minute per agent, checked before the route is resolved, under a kill switch scoped to one agent, one team or the whole estate that is evaluated first in the pipeline.

Deny by default, for agents. An action no role names is refused, an explicit deny beats every allow wherever it is written, and a delegation chain intersects at every hop so agent A cannot escalate by asking agent B.

One trace per governed request, opened at step 3 before the verdict is taken, so a request refused at step 6 is still recorded and the caller still receives a trace id in x-acp-trace-id.

A compliance officer’s question in English translated into a validated filter object over fourteen allow-listed fields, never into SQL, shown back as editable chips, with a deterministic keyword parser as the fallback. It cannot group, count or correlate across traces.

Webhook events on governance transitions — an approval requested, a policy decision, a budget window breached, the kill switch engaged — emitted at step 11 alongside the ledger write, with no notification integrations of their kind.

Every governance-plane change — an agent created, a policy widened, the kill switch engaged, an approval decided — appended to a hash chain whose entry digest covers the previous entry’s hash plus the canonical JSON of that entry’s own content.

SHA-256 by default, HMAC-SHA256 when an audit MAC key is held outside the database, the head sealed by a checkpoint MAC at every boot, and optional Ed25519 anchors published off-box on a schedule. Tamper-evident, not tamper-proof: unkeyed, an operator who rewrites a row and recomputes every hash after it verifies clean, and each verification result names which of the two you hold.

A compliance export containing the period’s traces and events, the approvals with approver identity and rationale, the audit entries covering every governance-plane change, a chain verification result naming the sequence number of any break, and a SHA-256 digest of the bundle at a recorded time. Digest-sealed, not signed.

Reads are themselves attributable. Trace list, search, detail and export reads are recorded; spend figures and recertification evidence are gated on the reader’s team scopes as well as their role; and organisation-wide views return 403 rather than a misleading partial answer without an explicit organisation-wide scope.

Self-hosted only, and bring-your-own-key. One Node process, one SQLite file and five surfaces; there is no hosted plan to start on and no managed tier to graduate to.

The vendor receives no product telemetry, phone-home data, prompts, keys or trace database in any configuration, because self-hosted is the only configuration. Governed payloads leave your network only for the model and tool providers you configure, after policy and redaction.

One build. Anchoring and the on-behalf-of intersection default to off because each needs a key or an identity provider you supply, not because they sit behind a tier.

OIDC SSO plus bounded SCIM user provisioning — userName, name and active lifecycle for viewer accounts with no evidence scopes, permitting disable but not rename or reactivation once an account holds more authority. SAML, SCIM Groups and live-directory reads are not built.

Source-available to the customer under a licence the repository itself describes as a template pending counsel. There is no separate community edition, and no feature is withheld from one.

A single-writer SQLite process on one host at the current target scale — roughly five to fifty agents owned by one platform team. No replica, no clustering and no vendor-operated uptime SLA, and because it fails closed its availability is a governance property of your environment.

No published price list. You pay your providers directly, because the deployment holds your keys and the vendor never sees the traffic.

Nothing is metered by the vendor. The only cost counter is your provider spend, priced per request before egress and written to a ledger in USD columns rounded to eight decimal places.

Unset by default, and unset means keep forever. That is a default to change deliberately rather than a feature: evidence you cannot lawfully still hold is a liability, not an asset.

Permissions, policy, approvals, budgets, the flight recorder, the audit chain and anchoring are one product with no feature tier and no licence key gating any of them.

No vendor-operated uptime commitment, and the reason is published: the vendor does not operate your deployment and has no telemetry from it, so an availability number from that party would be unmeasurable by either side.

None published: no SOC 2, no ISO 27001, no ISO 42001 and no independent penetration test. A pre-purchase test is welcome and expressly permitted by the licence, with no gag clause and no pre-approval of results.