Token Observe vs Amazon Bedrock AgentCore

The request itself, on an eleven-step path: authenticate, resolve the agent, open a trace, sanitise Unicode, scan, take one verdict, enact it, route, call upstream, govern any tool call the model proposes on the way back, then meter and record.

The whole payload and the agent record: the tool and its argument values, the model requested and its estimated input size, accumulated spend, request and token rate, detected data classes, the injection score and the source the text arrived from, and the hour in UTC.

Model dialects, tools and inbound agent calls: OpenAI, Anthropic and Gemini ingress surfaces, one Streamable HTTP MCP endpoint in front of every registered upstream MCP server, and a synchronous A2A v1.0 message endpoint advertised on a well-known agent card, whose caller traverses the same governance pipeline as one arriving on an SDK. That last surface is deliberately narrow: streaming, push callbacks, background tasks and URL or file dereference are rejected rather than partially implemented, and there is no Task store.

Both, from one evaluator. The same pure function decides a model call, an MCP tool call, a replayed backtest and the bundle compiled for a developer laptop, which is why a rule means the same thing wherever it is evaluated.

Change `OPENAI_BASE_URL` or `ANTHROPIC_BASE_URL` and one key. For supported OpenAI-compatible, Anthropic and Gemini ingress that is normally the whole integration rather than an application refactor.

Six first-class upstreams — OpenAI, Anthropic, Gemini, OpenRouter, Bedrock, Azure OpenAI — plus any OpenAI-compatible endpoint you register, with policy equivalence across them enforced by a table-driven test over every provider kind.

The same posture, on the action rather than the traffic: an agent may hold an allow on `tool:orderdb/get_details` while `tool:payments/issue_refund` is simply absent and therefore denied. An explicit deny beats every allow wherever it is written, and a delegation chain intersects rather than unions, so agent A gains nothing by asking higher-privileged agent B.

Shadow mode per policy rather than per gateway, so one rule can be learning its false-positive rate while every other rule keeps enforcing. Where the deployment turns the gate on, no rule may begin enforcing until a backtest of that exact rule has been replayed against recorded traffic and acknowledged by a named person, and the backtest reports “unknown” rather than “zero” when the recorded evidence cannot answer.

Tool-argument matchers over exact values, numeric comparisons and regular expressions, evaluated inside the same verdict as everything else. There is no separate authoring service: a rule is a trigger, an action and a scope, and shadow mode plus backtest is what stands in for automated reasoning about it.

A named human on one exact payload. A `require_approval` verdict returns 403 carrying the approval id, mints a record bound to the SHA-256 of the canonicalised action plus its execution context, is single-use through a compare-and-set so two concurrent retries cannot both execute, and expires at 60 minutes by default. Change one argument and the hash no longer matches, so the retry is refused as a mismatch.

Hard USD ceilings per request, per rolling hour, per UTC day and per UTC month, scoped to the agent rather than to a session it names for itself. Windows are projected and reserved before egress inside one per-agent transaction after the route resolves and every reachable fallback is priced at its most expensive rate; a budgeted route whose target cannot be priced is refused rather than priced at zero. Request, tool-call and token rate ceilings sit beside them, and a kill switch scoped to one agent, one team or everything is checked first.

Detection in-process, and a redaction plan rather than only a verdict. Eleven sensitive-data classes, three of them checksum-validated, and nine weighted injection heuristics scored 1.25 times higher when the text arrived as a tool result. Streamed responses pass a hold-back buffer with a 64-character floor and a separate channel per tool-call argument, because a card number split across two chunks otherwise escapes output redaction entirely.

Seven typed failure classes. A 429, a timeout and a 5xx move to the next provider; a content-policy refusal, an authentication failure, an over-long context and a malformed request stop where they are. Every fallback candidate is filtered through the agent’s retention, training and region policy before it can be used, so failing over cannot route around a data-policy constraint.

Two places, deliberately. Every governance-plane change — an agent created, a policy widened, the kill switch engaged, an approval decided — is appended to a hash chain, while each governed request opens a trace whose id is returned in a response header even when the request was blocked.

A chain, keyed if you configure it. Each entry’s digest covers the previous entry’s hash plus the canonical JSON of its own content, so an edit or deletion breaks verification at a named sequence number; set an audit MAC key and those digests become HMAC-SHA256 under a key held outside the database; set a signing key and the head is periodically signed with Ed25519 and published off-box. Tamper-evident, not tamper-proof, and the verification result reports which of the three you are holding.

OTLP over HTTP as an input rather than a destination: bounded JSON and protobuf for logs, traces and metrics, answering in the request encoding, with every write attributed to the credential that presented it. Token Observe is not a trace viewer for application spans and does not try to be one.

A compliance export sealed with a SHA-256 digest that carries the audit-chain verdict, plus an offline verifier that is one Node script with no install, no database and no network. The export is digest-sealed and not itself signed: durable origin evidence comes from the keyed chain and the Ed25519 anchor retained independently of the database.

A smaller register with a different job: every agent has an id, a named human owner, a team, a declared purpose, a risk tier, a lifecycle status and a budget, and it is the same record the gateway enforces against rather than a catalogue beside it. It discovers nothing — registering an agent is a deliberate act by a named person, and anything calling a model without a record is the shadow-AI radar’s problem.

Self-hosted only, in your network, on your keys: one Node process and one SQLite file in WAL mode at its current target scale. No replica, no clustering, no vendor-operated uptime SLA, and it fails closed, so its availability becomes a governance property of your environment.

Nowhere the vendor can reach. The Token Observe vendor receives no product telemetry, phone-home data, prompts, keys or trace database; governed payloads leave your network only for the model and tool providers you configure, after policy and redaction.

Wherever you run the process, including environments with no egress at all — the licence is drafted to permit air-gapped operation, though it remains a template pending counsel. For Bedrock specifically, a declared policy region is bound to a region proven by an AWS-owned runtime endpoint and a contradiction fails closed, which proves configuration consistency rather than data residency.

Federation and nothing more, on purpose. OIDC sign-in for console users, directory groups mapped to roles taken as a snapshot with a 24-hour default staleness rather than a live directory read, and bounded SCIM user provisioning. Agent credentials are long-lived hashed bearer tokens, which is a recorded decision rather than an oversight, compensated by revocation and expiry.

None. No SOC 2, no ISO 27001, no ISO 42001, no independent penetration test — stated first rather than on request. What exists instead is a published known-issues list naming the attacks that still work, a STRIDE threat model with residual risk on every row, and a licence that expressly permits a pre-purchase test with no gag clause.

No published price. The commercial licence is a template pending counsel, and any figure you are quoted comes from a conversation rather than from a page.

Nothing per request. You pay for the host you run it on and for the provider bills it meters, and the cost control is the point: usage is normalised into mutually exclusive token buckets before any arithmetic, because Anthropic reports cache reads and writes outside the input total while OpenAI and Gemini report them inside it.

Disk. Traces live in the same SQLite file as everything else, and the default trace retention is keep-forever — which is a deliberate evidence choice and a storage bill you own, so size it before you turn the gateway on rather than after.

The governance domain. `packages/core` holds it as pure functions with zero runtime dependencies, so what “allow” means is readable and testable without a database, a network or a clock — and the same evaluator decides the gateway, the MCP path and the backtest.