--- title: "Token Observe versus Palo Alto Prisma AIRS" canonical_url: "https://tokenobserve.com/vs/prisma-airs" published: 2026-09-02 last_updated: 2026-10-21 sources_checked_on: 2026-10-05 --- # Token Observe versus Palo Alto Prisma AIRS Prisma AIRS scans the content and caps what a workspace may spend and call. Token Observe decides whether one named agent may make this exact call, and who approved it. Provenance: every statement about Palo Alto Prisma AIRS below paraphrases Palo Alto Networks's own published material as it stood on 2026-10-05. None of it has been independently tested. A capability absent from a vendor's documentation is not the same thing as a capability the product lacks. ## Sources - Prisma AIRS product page: https://www.paloaltonetworks.com/ai-security/prisma-airs - Prisma AIRS Overview (administration): https://docs.paloaltonetworks.com/prisma-airs/getting-started/prisma-airs-overview - Prisma AIRS AI Runtime: API Intercept Overview: https://docs.paloaltonetworks.com/prisma-airs/ai-runtime-security/airs-api/ai-runtime-security-api-intercept-overview - Prisma AIRS API Intercept developer portal: https://pan.dev/airs/ - AI Runtime Security API use cases and scan schema: https://pan.dev/prisma-airs/api/airuntimesecurity/usecases/ - Prisma AIRS Licenses: https://docs.paloaltonetworks.com/prisma-airs/activation-and-onboarding/prisma-airs-licenses - License for AI Runtime Security: Network Intercept: https://docs.paloaltonetworks.com/prisma-airs/activation-and-onboarding/license-ai-runtime-firewall - License for AI Runtime Security: API Intercept: https://docs.paloaltonetworks.com/prisma-airs/activation-and-onboarding/license-ai-runtime-api - Create a deployment profile for Prisma AIRS AI Runtime firewall: https://docs.paloaltonetworks.com/prisma-airs/ai-runtime-security/airs-vm-firewall/create-an-ai-instance-deployment-profile-in-csp - Prisma AIRS API Scan Logs: https://docs.paloaltonetworks.com/prisma-airs/ai-runtime-security/airs-api/ai-runtime-security-intercept-scan-logs - Understanding the Prisma AIRS MCP Server: https://docs.paloaltonetworks.com/prisma-airs/ai-agent-identity/understanding-the-prisma-airs-mcp-server - New Features — Prisma AIRS, August 2026 (Anthropic Inference Hooks, OpenAI Codex): https://docs.paloaltonetworks.com/ai-runtime-security/new-features/by-date/prisma-airs/august-2026 - New Features — Prisma AIRS, June 2026: https://docs.paloaltonetworks.com/ai-runtime-security/new-features/by-date/prisma-airs/june-2026 - Prisma AIRS Agent Security: https://www.paloaltonetworks.com/ai-security/agent-security - AI Gateway Policies and Profiles: https://docs.paloaltonetworks.com/prisma-airs/ai-gateway/ai-gateway-policies-profiles - AI Gateway Workspaces: https://docs.paloaltonetworks.com/prisma-airs/ai-gateway/ai-gateway-overview/ai-gateway-workspaces - Create an AI Security Profile: https://docs.paloaltonetworks.com/prisma-airs/ai-runtime-security/airs-vm-firewall/create-ai-security-profile - SaaS Agent Security Overview: https://docs.paloaltonetworks.com/prisma-airs/ai-agent-identity/saas-agent-security-overview - AI Gateway Overview: https://docs.paloaltonetworks.com/prisma-airs/ai-gateway/ai-gateway-overview - AI Gateway Deployment Models: https://docs.paloaltonetworks.com/prisma-airs/ai-gateway/ai-gateway-overview/ai-gateway-deployment-models ## The comparison Prisma AIRS decides whether a payload is malicious and, through its AI Gateway, what a workspace or API key may spend and call; Token Observe decides whether one named agent may make this exact call, and parks it on a named person when policy says a person must decide. Palo Alto publishes the shape of the first decision in the response schema itself: a scan against the AI Runtime API returns an “action” of allow or block and a “category” of malicious or benign, with per-direction booleans for dlp, injection, url_cats, db_security, toxic_content, malicious_code, ungrounded and topic_violation, resolved against the AI profile the request names. Around that sit a Network intercept the documentation calls “an inline security intercept that provides real-time, AI-powered network protection” across inbound, outbound and east-west traffic, an MCP server exposing a pan_inline_scan() tool, model scanning, red teaming and posture management: a materially wider estate than Token Observe covers or claims to. Two of those pillars overlap Token Observe directly rather than sitting beside it: Agent Security describes defining AI agent ownership and permissions and enforcing least-privileged access, and the AI Gateway is an in-path proxy whose documentation, listed for the Americas region, describes budget limits in USD or tokens per workspace with finer rules per user, API key, model or provider, request rate limits per minute and per day, model allow- and deny-lists, and Agent Endpoint rules that define what operations each registered agent may perform. Token Observe takes a different judgement at step 6 of an eleven-step path: whether this named agent, holding these deny-by-default action-level grants, through this delegation chain, inside these USD and rate ceilings, was permitted to make this exact call, and whether a named person must approve this specific payload before it proceeds. If the requirement is detection quality across the whole AI estate, Prisma AIRS is the better purchase, as the concession section below sets out. If the requirement is to prove afterwards that the action a named person authorised is the action that happened, that is a different control rather than a smaller version of the same one. ## The stated limit Detection is not the product here: Nine injection patterns, eleven data classes, all heuristic ## Where they win: On detection, on estate coverage, on gateway breadth, and on the assurance a procurement team can read, Prisma AIRS is the better purchase for most readers Detection quality is Palo Alto’s product, not Token Observe’s, and the gap is wide. The developer portal names eleven detection services in one list (prompt injection, malicious URLs, sensitive data loss, masking of sensitive data, database security attacks, toxic content, malicious code, AI agent threats, contextual grounding, custom topic guardrails and secure MCP), maintained by a vendor whose business is threat research. Token Observe ships nine weighted regular expressions for injection, scored 1.25 times higher when the text arrived as a tool result, and eleven sensitive-data classes of which three are checksum-validated. A novel phrasing that matches none of the nine scores zero. The product’s own documentation concedes this: heuristic detection has false negatives, that residual risk requires a named CISO’s dated written acceptance, and injection findings are treated as one input to policy rather than as the control. Estate coverage is the second and larger advantage. The overview describes the Network intercept as an inline security intercept giving real-time network protection across inbound, outbound and east-west traffic, deployable in GCP, AWS and Azure and in on-premises and private infrastructure, and the product page describes a managed option as “a fully managed, next gen firewall that blocks prompt injections and data leaks”. That sees traffic which never presents a Token Observe credential, which in a real organisation is most of the AI activity. Token Observe sees what routes through its gateway and nothing else; everything beyond that is a shadow-AI radar finding, and the support boundary says that chasing those down inside your organisation is your work. Third, the parts of the platform Token Observe has no answer to at all. AI Model Security scans third-party models for vulnerabilities before deployment. AI Red Teaming simulates attacks against your own agents and applications, and the June 2026 release notes add multilingual adversarial testing in French, Japanese, Thai and Hindi, plus a privilege-misuse category that tests whether agents correctly enforce authorisation boundaries under manipulation. AI posture management sits alongside both. None of these exist in Token Observe, none are on its roadmap, and its own strategy document names a generic AI firewall, prompt scanner or red-team platform as a strategic non-goal, so it does not claim otherwise. Fourth, and the one that decides real deals: Palo Alto is a company a procurement team already has a file on, and its licence bundles services an enterprise may already run: the licensing pages list Cloud Identity Engine, Strata Cloud Manager Pro, Enterprise DLP and Advanced Threat Prevention with the AI Runtime Firewall, and Enterprise DLP and Strata Logging Service with the API. Ask Palo Alto which certifications and independent test results apply to Prisma AIRS specifically, for what scope and to what date, because that is the only version of the answer worth having and this page does not hold it for them. Token Observe holds none: no SOC 2, no ISO 27001, no ISO 42001, no independent penetration test. If that is your gate, the comparison ends here in Palo Alto’s favour. Fifth, and the concession this page got wrong first time: the overlap is wider than a detection-versus-authority framing suggests. Agent Security is sold on defining AI agent ownership and permissions and enforcing least-privileged access, on identifying excessive access and revoking unnecessary privileges, and on enforcing granular policies on how agents interact with systems. The AI Gateway (Palo Alto’s Agent Security page says “Portkey’s AI Gateway is being integrated into Prisma AIRS”) sits in the request path as a proxy to more than 1,600 models across 50 or more providers, with load balancing, fallback and response caching. Its documentation describes budget limits per workspace in USD or in tokens with weekly or monthly reset, finer budget rules scoped per user, API key, model or provider, request rate limits per minute and per day, access policies that enforce model allow- and deny-lists per workspace or API key, inline guardrails that run before traffic reaches the provider, and Agent Endpoint rules that govern how agents authenticate when calling other agents or MCP servers and what operations each registered agent may perform. It runs as SaaS or as a Hybrid data plane in your own Kubernetes cluster, where payloads stay in your environment, and the gateway pages read here list it for the Americas region. Those are the same kinds of control Token Observe sells, with wider provider reach, from a vendor already in the estate. The differences to test are unit and precedence: whether a grant names one action on one resource for one agent, whether an explicit deny beats every allow, whether authority narrows when one agent calls another, and whether an approval can be bound to one exact payload. Those are questions for Palo Alto rather than answers this page can give on their behalf. Everything above and everything in the table comes from Palo Alto’s own published pages, read on 5 October 2026 and listed in the sources. Nothing has been independently tested, there has been no witnessed bake-off, and where a cell reads as an absence it uses the words “not described in their published documentation”; treat those as questions to put to Palo Alto in writing rather than as findings. ## Head to head ### Where it sits in the request path Position Palo Alto Prisma AIRS: Two intercepts and a gateway. The Network intercept is described as “an inline security intercept that provides real-time, AI-powered network protection” monitoring inbound, outbound and east-west traffic. The API intercept embeds “Security-as-Code directly into your source code”, with the application calling /v1/scan/sync/request or /v1/scan/async/request. The AI Gateway, listed for the Americas region, “sits between your users and applications and every large language model (LLM) provider they call”, reached through one OpenAI-format endpoint. Token Observe: In customer-hosted mode: One self-hosted process inside your network, in the path by construction. Change OPENAI_BASE_URL or ANTHROPIC_BASE_URL and one key; for supported OpenAI-compatible, Anthropic and Gemini ingress that is normally the whole integration. The cloud pilot hosts the workspace on the service and holds its evidence and supplied credentials. Who carries out the verdict Palo Alto Prisma AIRS: On the API intercept the scan returns the verdict and something downstream acts on it. The Anthropic Inference Hooks integration announced in the August 2026 notes shows the strongest form of that: Anthropic sends the prompt to the AIRS Runtime API for inspection before the model processes it, and on a block verdict the prompt is not forwarded to the model and the user receives a customisable error message instead; the notes list it for the US region and text content only. The Network intercept stops traffic itself, and the AI Gateway’s guardrails run before traffic reaches the provider, with a key expired when its budget is reached. Token Observe: Token Observe returns the refusal. A block at step 6 is a typed error and the trace closes as blocked; nothing downstream has to choose to honour it, because there is no downstream to choose. Note: This is a difference in integration shape rather than in strength. An inline firewall and an in-path gateway both stop the request themselves; a scan API is only as binding as whatever calls it. Palo Alto now ships both shapes: the scan API needs a caller to honour it, while the Network intercept and the AI Gateway hold the request themselves, as Token Observe does. What is submitted for inspection Palo Alto Prisma AIRS: A contents array carrying prompt, response, code_response and context, with metadata holding app_user, ai_model, optionally app_name and user_ip, and a tr_id transaction identifier. The ai_profile is named by profile_name or profile_id. Token Observe: Unicode is sanitised at step 4 so smuggled invisible characters are stripped before any detector reads the payload, scanning runs at step 5, and a tool call the model proposes on the way back is re-evaluated at step 10 against tool_call policies. Note: Token Observe can only refuse a proposal it is shown. Governing the returned tool call is defence in depth, not a guarantee. MCP tool calls Palo Alto Prisma AIRS: The Prisma AIRS MCP server is documented as intercepting tool invocations, performing security analysis and returning a verdict on whether a threat was detected. It exposes pan_inline_scan(), “a synchronous tool that scans text for threats”, returning an action of allow or block, and agents are instructed to scan the user prompt at stage one and the generated response at stage two. Token Observe: In customer-hosted mode: One Streamable HTTP endpoint in front of every registered upstream MCP server, where the same evaluator that governs a model call governs a tool call. Tools reach an agent namespaced server.tool and filtered to that agent’s grants, and every call is authorised again at execution because filtering a list is usability rather than access control. Arbitrary upstream MCP destinations are disabled in the initial cloud environment. Tool descriptor changes Palo Alto Prisma AIRS: Secure MCP is named among the detection services on the developer portal; a hash of a tool’s descriptor taken at approval and re-checked on refresh is not described in their published documentation as of 5 October 2026 on the pages read here. Token Observe: Each tool’s name, description and input schema is hashed when an operator approves it and re-checked on every catalogue refresh; a descriptor rewritten upstream quarantines the tool until a human approves it again. That is the answer to a rug-pull rather than to a prompt. Size of what can be inspected Palo Alto Prisma AIRS: Published per scan: 2 MB maximum payload per synchronous request and 5 MB per asynchronous request. For contextual grounding, context is capped at 100,000 characters, prompt at 10,000 and response at 20,000. Token Observe: Streaming egress passes through a hold-back buffer with a 64-character floor and a separate buffer per tool-call argument channel, bounded at 4,096 characters per channel, so a card number split across two chunks cannot escape redaction and an unterminated run is suppressed rather than half-emitted. ### What it enforces Detection catalogue Palo Alto Prisma AIRS: Eleven services named on the developer portal: Prompt Injection, Malicious URLs, Sensitive Data Loss, Mask Sensitive Data, Database Security Attack, Toxic Content, Malicious Code, AI Agent Threats, Contextual Grounding, Custom Topic Guardrails and Secure MCP. Token Observe: Nine weighted injection patterns over Unicode-sanitised text, scored 1.25× when the text is a tool result, and eleven sensitive-data classes. Not a classifier: a novel phrasing that matches none of the nine scores zero. Note: On detection this row is not a contest. It is here so the two catalogues can be read side by side, not so Token Observe can win it. Shape of the verdict Palo Alto Prisma AIRS: The scan result carries action — block or allow — and category — malicious or benign — with prompt_detected and response_detected objects holding booleans for dlp, injection, url_cats, db_security, toxic_content, malicious_code, ungrounded and topic_violation, plus profile_id, profile_name, scan_id and report_id. The action follows the security profile the request names: the overview describes the Scan API as providing actionable recommendations, and the AI security profile page describes configuring AI model, AI application and AI data protection, with Allow, Alert or Block available as actions. Token Observe: Seven trigger kinds — the tool being called and its argument values, the model and its estimated input size, accumulated spend, request and token rate, detected data classes, injection score and its source, and the hour of day in UTC — resolved into one of five actions, where a block beats an approval and an approval beats a redaction. Caller identity and permissions Palo Alto Prisma AIRS: Palo Alto claims this directly. The Agent Security pillar is described as “verifying every agent identity and enforcing real-time security to stop unauthorized actions”, and its page says you can “Define AI agent ownership, permissions and enforce least-privileged access for AI agents”, “Identify excessive access, revoke unnecessary privileges and reduce the blast radius of compromised or misconfigured agents”, and gain centralised control of tool calls, LLM interactions and MCP connections, “enforcing granular policies on how agents interact with systems”. The AI Gateway Policies and Profiles page documents access policies that enforce model allow- and deny-lists per workspace or API key, and Agent Endpoint rules that control how autonomous agents authenticate when calling other agents or MCP servers through the gateway and “define what operations each registered agent is permitted to perform”. The gateway pages are listed for the Americas region. In the scan API itself, identity is still caller-supplied metadata: app_user, app_name and ai_model. Token Observe: Deny-by-default action-level RBAC over resources such as model:gpt-5o-mini and tool:orderdb/*, where an explicit deny beats every allow in any role, and a delegation chain intersects rather than unions, so agent A cannot escalate by asking higher-privileged agent B. Note: This row is an overlap rather than a gap, and agent-to-agent calls are now part of it. Both products name a registered agent and govern what it may do. What is worth putting to Palo Alto is granularity and precedence — whether a grant is expressed per action on a named resource, whether an explicit deny wins over every allow, and whether authority narrows to the intersection when one agent calls another. The pages read here do not settle those, and this page does not answer them for Palo Alto. Human decision in the loop Palo Alto Prisma AIRS: The documented scan outcomes are allow and block, and the AI Gateway Policies and Profiles page read on 5 October 2026 covers budget limits, rate limits, access policies, guardrails and agent endpoint rules without describing an approval queue. A request parked on a named person for approval before it proceeds is not described in their published documentation as of 5 October 2026 on the pages read here. Palo Alto ships monthly and sells across a wide portfolio, so treat this as a question to put to them rather than a finding. Token Observe: A 403 carrying an approval id, bound to the SHA-256 of the canonical action plus the execution context it was proposed in, single-use by compare-and-set, expiring at 60 minutes by default and from one minute to seven days by policy. Change one argument and the retry is refused as a mismatch. Note: Approving pushes nothing to the agent. Token Observe has no way to call an agent back; the agent redeems the approval by repeating the identical request with its id. Rate and volume ceilings Palo Alto Prisma AIRS: Two kinds. On the Scan API, per-tenant rate limiting published as RPS controlling call frequency and TPM controlling payload density, auto-calculated from the deployment profile’s monthly token quota, returning HTTP 429 when exceeded, with increases beyond 150 RPS and 15M TPM available through Palo Alto support. Separately, the AI Gateway Policies and Profiles page documents rate limits that cap how many requests a workspace can make per minute and per day, to stop runaway usage exhausting provider quotas and to protect other workspaces from one high-traffic consumer. The gateway pages are listed for the Americas region. Token Observe: Requests, tool calls and tokens per minute per agent, checked before egress, alongside the USD ceilings below. Note: The Scan API limits bound how much you may scan. The AI Gateway limits bound how much a caller may consume, which is the same kind of control Token Observe applies — so read the second half of this row as an overlap. The documented unit differs: their rate limits are set per workspace, Token Observe’s per named agent, and they count requests where Token Observe also counts tool calls and tokens. Spend ceilings on model usage Palo Alto Prisma AIRS: Documented on the AI Gateway Policies and Profiles page: budget limits are “Financial guardrails that cap spending per workspace”, set as a cost limit in USD or as a token limit, with alert thresholds for advance notice and weekly or monthly reset; when the limit is reached the associated key is expired. Finer budget rules scoped per user, API key, model, provider or metadata condition are configured through the Admin API. The gateway pages are listed for the Americas region. Token Observe: USD ceilings per request, per rolling hour, per UTC day and per UTC month, scoped to one named agent, projected against every provider and fallback the resolved route could execute and reserved in one per-agent transaction. A budgeted agent whose route has an unpriced reachable target is refused with a 409 before egress rather than priced at zero. Note: Both products cap spend in currency, so this row is an overlap and not a differentiator. What differs is the window and how the cost is projected. Theirs attaches to a workspace, or through Admin API rules to a user, API key, model or provider, and resets weekly or monthly, and at the limit the key is expired. Token Observe’s attaches to one agent, is checked per request, per rolling hour, per UTC day and per UTC month, and is projected against every fallback the route could reach before the call goes out. Whether a per-key rule can stand in for a per-agent ceiling is a question to put to Palo Alto. Turning a rule on without breaking work Palo Alto Prisma AIRS: The AI security profile page lists Alert alongside Allow and Block, with an AI security log generated when a query is detected with the action alert or block, and the June 2026 notes describe red-team target profiling that can be enabled immediately or deferred. Token Observe: Every policy can run in shadow mode first, recording what it would have done without stopping anything. Where the deployment turns the gate on, no rule may begin enforcing until a backtest of that exact rule has been replayed against recorded traffic and acknowledged by a named person. ### What it records What a decision produces Palo Alto Prisma AIRS: An API scan log holding “Scan ID, API Key, Profile ID, Profile Name, Application Name, Model Name, Report ID, prompt detection types (request or response), verdict, and the corresponding action taken”. Token Observe: A trc_ trace id minted at step 3, before the verdict, so a blocked request is recorded rather than merely refused, and returned in x-acp-trace-id on every response — alongside the tool calls and arguments, the policy decisions, the approvals, the tokens and the cost. Prompt and reply text is kept only if you switch conversation capture on, redacted before truncation; the default keeps none. Where the record lives Palo Alto Prisma AIRS: “Strata Logging Service generates the AI security logs when AI security threats are detected between AI applications and AI models.” A log forwarding profile in Strata Cloud Manager sends them onward to a SIEM by IP or URL. Token Observe: Cloud pilot or customer hosting. The cloud service holds workspace evidence and supplied credentials; customer-hosted installations keep runtime state on your infrastructure without vendor phone-home. These data-custody statements depend on the chosen mode. Tamper-evidence Palo Alto Prisma AIRS: Not described in their published documentation as of 5 October 2026 on the pages read here; the scan-log pages describe fields and forwarding rather than an integrity claim over the record. Token Observe: A hash chain in which each row’s digest covers its canonical content plus the previous row’s, sealed at every boot with a MAC when an audit key is configured, and anchored with an Ed25519 signature published off the box once a signing key is set. Tamper-evident, not tamper-proof — and unkeyed by default, where a rewrite that recomputes every downstream digest verifies clean. Retention Palo Alto Prisma AIRS: A retention period for API scan logs is not stated on the scan-log page read on 5 October 2026; retention on Strata Logging Service is worth confirming with Palo Alto for your contract. Token Observe: Cloud activity retention is configured to 30 days. For customer hosting: Trace retention is unset by default, and unset means keep forever. Setting a window is a decision you take rather than one the product takes for you, which is a storage-growth and data-minimisation problem rather than an evidence-loss one. Who authorised it Palo Alto Prisma AIRS: The scan record names the profile that decided and the app_user the caller supplied as metadata. A named human approver recorded against a specific action is not described in their published documentation as of 5 October 2026 on the pages read here. Token Observe: The approver is recorded against the trace, with the approval bound to the exact payload they saw, so the question “who said this refund could happen” has a name and a hash rather than a timestamp. Evidence a third party can check Palo Alto Prisma AIRS: SIEM forwarding through a log forwarding profile is the documented export path on the pages read here, with scan_id and report_id identifying a scan for follow-up. Token Observe: An export sealed with a SHA-256 digest over canonical JSON, carrying the audit-chain verdict, verifiable by one Node script with no install, no database and no network: exit 0 trusted, exit 1 not. Digest-sealed, not signed. ### How it deploys and who operates it Deployment model Palo Alto Prisma AIRS: The Network intercept runs in “public clouds such as GCP, AWS, and Azure environments” and in “on-premises and private infrastructure”. The API intercept is a Palo Alto-operated scan API, with “One API key per deployment profile” and each key usable only within the region it was created in. The AI Gateway runs as SaaS by default or as a Hybrid data plane installed by Helm chart in your Kubernetes cluster, listed for the Americas region. Token Observe: Cloud pilot or customer hosting. The cloud service holds workspace evidence and supplied credentials; customer-hosted installations keep runtime state on your infrastructure without vendor phone-home. These data-custody statements depend on the chosen mode. Management plane Palo Alto Prisma AIRS: Strata Cloud Manager, where deployment profiles, log forwarding profiles and the scan-log views live, with Panorama named in the overview as an alternative management method for the Network intercept. Both AI Gateway deployment models are managed from Strata Cloud Manager. Token Observe: The cloud pilot provides a hosted portal and workspace console. In customer-hosted mode, the runtime serves the React console and control API from your infrastructure. Where payloads travel for the control itself Palo Alto Prisma AIRS: On the API intercept the prompt and response are posted to a Prisma AIRS regional endpoint to be scanned; with Anthropic Inference Hooks, Anthropic sends the prompt to the AIRS Runtime API before the model processes it. The AI Gateway offers two data planes: SaaS, where payloads are “routed through Palo Alto Networks infrastructure”, and Hybrid, hosted in your own Kubernetes cluster, where they are “never transmitted to Palo Alto Networks”. In both, workspace configuration, guardrail policies and observability dashboards run in Strata Cloud Manager. Token Observe: Detection and policy evaluation run in the workspace runtime. In cloud mode that runtime and its evidence are on the service; in customer-hosted mode they are on your infrastructure. Governed payloads are forwarded to configured providers after policy and redaction. Note: Palo Alto’s Hybrid gateway narrows this row for traffic that goes through it. What remains different is the management plane, which for the gateway runs in Strata Cloud Manager, and the scan path: the deployment-models page read on 5 October 2026 does not say where a guardrail that invokes the AI Runtime Security inspection policy sends the payload, which is worth confirming with Palo Alto. Provider and platform coverage Palo Alto Prisma AIRS: On the scan API the model is caller-supplied as an ai_model metadata field rather than fixed by the product; in the AI Gateway, model provisioning per workspace is described as “an allowlist that restricts which models the workspace can call”, and the overview says the gateway connects to more than 1,600 LLMs across 50 or more providers, including OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, Mistral, Cohere and self-hosted models. The August 2026 notes add platform integrations with Anthropic Inference Hooks and with OpenAI Codex Enterprise. Token Observe: OpenAI, Anthropic, Gemini, OpenRouter, Amazon Bedrock and Azure OpenAI as first-class upstreams, plus any OpenAI-compatible endpoint you register. A table-driven test asserts that policies, redaction, budgets and tracing behave identically across every provider kind. Availability posture Palo Alto Prisma AIRS: Palo Alto operates the scan API and offers a managed runtime option described as “a fully managed, next gen firewall”. Availability commitments sit in their commercial agreements rather than on the pages read here. Token Observe: No availability SLA is offered. The cloud pilot runs on one shared host and has not qualified customer capacity or live recovery. In customer-hosted mode, operating the runtime and its recovery is your responsibility. The gateway fails closed, so an unavailable runtime stops governed model calls. Behaviour when the control cannot do its job Palo Alto Prisma AIRS: Configurable, and documented on the AI security profile page. A profile carries a Max Inline Latency setting from 1 to 300 seconds and an Inline Timeout Action of Allow, Alert — reporting threats asynchronously — or Block, so the deployment chooses whether a detection that overruns fails open or closed. The page read on 5 October 2026 does not state a default, which is worth confirming with Palo Alto. Token Observe: It fails closed, deliberately. If the boot-time walk of the audit chain finds corruption, readiness latches and governed requests receive a 503 carrying ACP_AUDIT_UNAVAILABLE; restarting does not clear it, and recovery means restoring a database whose chain and independently retained head verify. ### What it costs and what you sign Licensing shape Palo Alto Prisma AIRS: A bring-your-own-licence model: retrieve an authcode from the Palo Alto Networks Customer Support Portal and apply it, funded from a Software NGFW credit pool. Token Observe: No published price list. Token Observe is sold through a conversation, and this page does not pretend otherwise. Unit of consumption Palo Alto Prisma AIRS: For the Network intercept, the deployment profile defines how many vCPUs and instances you plan to use so the system can allocate credits, with processing capped at 10K AI transactions per day per vCPU. For the AI Runtime API, “credit usage is calculated in monthly tokens (billions) where each token is equal to four characters”, and the quota resets at the end of each calendar month. Token Observe: Self-hosted, so the cost is your compute and your storage. Detection and policy evaluation run in-process with no per-character or per-token inference charge. Note: That is the flip side of the detection concession above, not a win: the reason it costs nothing per character is that it is regular expressions rather than a maintained detection service. What the licence bundles Palo Alto Prisma AIRS: The AI Runtime Firewall licence is documented as incorporating Cloud Identity Engine, Strata Cloud Manager Pro, Enterprise Data Loss Prevention and Advanced Threat Prevention among others; the API licence includes Pro cloud management with Strata Cloud Manager and ADEM, Enterprise DLP and Strata Logging Service. Token Observe: One artefact. There is nothing else to license, and nothing in the estate that has to be a Palo Alto product for it to work. Model spend Palo Alto Prisma AIRS: Prisma AIRS licensing meters scanning rather than inference. Where the AI Gateway sits in front of providers it also governs the spend: its Policies and Profiles page documents budget limits in USD or tokens per workspace, and the workspaces page says each logged request records what it cost in flex credits. Whose contract the underlying inference is billed on is a question for Palo Alto rather than something the pages read here settle. Token Observe: You keep your own provider contracts and your own keys. Fifty shipped price rows load additively on every boot, and provider usage is normalised into mutually exclusive buckets before any arithmetic, because Anthropic reports cache reads and writes outside the input total while OpenAI and Gemini report them inside it. Licence and evaluation Palo Alto Prisma AIRS: Terms sit in Palo Alto’s commercial agreements rather than on the Prisma AIRS pages read here, and the licensing page read on 5 October 2026 describes an authcode flow without describing a trial. Ask Palo Alto what evaluation terms are available for Prisma AIRS specifically. Token Observe: A licence granting a 30-day evaluation written so a prospective customer’s security team can read, run and attack the software before a purchase order is raised, with benchmark results publishable with no pre-approval once the version and configuration tested are named and security findings publishable after coordinated disclosure. The published text is a template pending review by counsel in England and Wales, so read it as the intended terms rather than an executed grant. Independent assurance Palo Alto Prisma AIRS: Ask Palo Alto which certifications and independent test results cover Prisma AIRS specifically, for what scope and to what date. This page does not hold that answer for them. Token Observe: None. No SOC 2, no ISO 27001, no ISO 42001, no independent penetration test. The pre-purchase test is offered because the test does not yet exist. ### Both products now govern the sender. Only one documents an approval bound to the exact call The Prisma AIRS scan response is unusually explicit about the question it answers, which makes the comparison easy to draw. The result carries an action of allow or block and a category of malicious or benign, and beneath those a set of per-direction booleans naming what was found: dlp, injection, url_cats, db_security, toxic_content, malicious_code, ungrounded, topic_violation. Every one of those is a property of the text. The request does carry app_user, app_name and ai_model, but those arrive as metadata the caller supplies for its own reporting, and the profile that decides is named by the caller too. Token Observe asks the second question at the same point in the path. The agent that sent the request has an id, a named human owner, a team, a declared purpose, a risk tier, a lifecycle status and a budget, and its permissions are action-level and deny-by-default: a support agent may Read: Customer Account and Update: Shipping Address, while Delete: Account is absent and therefore denied. An explicit deny beats every allow in any role. Where one agent calls another, the delegation chain intersects permissions at every hop, so an agent gains nothing by asking a higher-privileged one to do the thing it was refused. The practical difference shows up in the rule you can write. “Block anything that looks like a prompt injection” is expressible in both, and Palo Alto will express it better. “This agent may issue a refund up to £200, above which a named person approves that exact refund, and the approval is spent the moment it is used” needs an identity, an action-level grant and an approval bound to a payload rather than to an action type. A verdict about the bytes cannot express it, and nothing about that is a criticism of a verdict about the bytes. Palo Alto does not stop at the scan: the Agent Security pillar sells agent ownership, permissions and least-privileged access, and the AI Gateway documentation describes budget limits, rate limits, model allow- and deny-lists, and Agent Endpoint rules over what each registered agent may do. The part of that rule which stays unanswered on their published pages is the approval — a specific payload parked on a named person, single-use, spent on redemption — and that is the part to raise with them rather than to assume. It matters because the two failure modes are different. Detection fails by missing something. Authority fails by permitting something. A control that only detects has nothing to say about an agent behaving exactly as instructed by a legitimate user who should not have been able to instruct it, and a control that only authorises has nothing to say about an instruction smuggled into a tool result. That is why the recommendation is to run both. - Their verdict: allow or block, with category malicious or benign and eight detection booleans per direction, resolved against the AI profile the request names. - Token Observe’s verdict: Five policy actions — block, require approval, redact, warn and suspend the agent — resolved from up to seven trigger kinds into one verdict at step 6 of allow, block or require approval plus a redaction plan, with a block beating an approval and an approval beating a redaction. - Where they overlap: Prompt-injection scoring and sensitive-data detection on the same payload. Run one of them as authoritative for egress and the other in observe-only, because two redaction engines in series double the false-positive surface without doubling the protection. ### A verdict is only as binding as whatever is holding the request This is the row a buyer should press hardest on, in either direction. Palo Alto ships both shapes and documents them separately. The Network intercept is an inline security intercept: the traffic is held by a firewall, and the firewall stops it. The API intercept is the opposite arrangement: the application calls /v1/scan/sync/request, receives an action of allow or block, and then decides what to do about it. Between those two sits the integration pattern that is the most interesting thing in the API documentation: with Anthropic Inference Hooks, announced in the August 2026 notes, the call direction reverses: Anthropic sends the prompt to the AIRS Runtime API for inspection before the model processes it, and on a block verdict the prompt is never forwarded to the model and the user receives a customisable error message instead. Existing Prisma AIRS scan profiles apply to Claude traffic, a reference ID returned in the denial ties a blocked prompt to its scan report, and the notes describe it as available in the US region and for text content only. Token Observe only ever has the first shape, and it has it because it is the process holding the connection. The verdict at step 6 is not advice returned to a caller who may ignore it; on block, the request never reaches the provider, a typed error goes back, and the trace closes as blocked. That is a smaller claim than it sounds (it says nothing about detection quality), but it removes one question from a security review, which is what happens if the calling application skips the scan. Palo Alto’s AI Gateway removes the same question for traffic routed through it, since its guardrails run before traffic reaches the provider, so on this point the line falls between a scan API and a gateway rather than between the two vendors. The MCP path is the same argument in miniature. Palo Alto’s MCP server is documented as intercepting tool invocations, scanning them through pan_inline_scan() and returning a verdict, with the agent instructed to scan its prompt at stage one and the response at stage two. Token Observe’s MCP gateway sits in front of every registered upstream server instead, filters the tool list to the agent’s grants, and re-authorises every call at execution, because a filtered list is a usability feature and a client can guess a tool name. Both approaches have the same hard boundary: a tool call that never reaches either of them is governed by neither. - Their inline shape: The Network intercept, described as real-time AI-powered network protection over inbound, outbound and east-west traffic, deployable in GCP, AWS, Azure and on-premises. - Their in-app shape: The API intercept — a scan the application makes and a verdict it honours, with published payload caps of 2 MB synchronous and 5 MB asynchronous. - Their provider-enforced shape: Anthropic Inference Hooks, where the provider sends the prompt for inspection before the model processes it and does not forward a prompt that receives a block verdict. - Their gateway shape: The AI Gateway, a proxy between applications and providers whose guardrails, budgets and rate limits apply before the request goes out, listed for the Americas region. - Token Observe’s customer-hosted shape: In the path, always. A base-URL change makes it the connection the agent holds, and the refusal is the response. ### What Token Observe is designed to take from a Palo Alto deployment The product’s roadmap names a generic AI firewall, prompt scanner or red-team platform as one of seven strategic non-goals, and the recorded consequence for this category is to consume threat and identity verdicts from platforms including Prisma AIRS rather than reproduce them. That is not a diplomatic sentence written for a comparison page; it is the reason the shadow-AI radar exists in the shape it does. The radar reconciles evidence rather than inspecting traffic, and four of its five sources come from outside. One of its six vendor-shaped receivers is Palo Alto Strata Logging Service — the same service the Prisma AIRS documentation says generates AI security logs when threats are detected between AI applications and models, and which Strata Cloud Manager can forward onward through a log forwarding profile. So the integration is a log forwarding profile you configure in a console you already administer, delivering on a credential Token Observe issued. The direction is the whole security argument. Token Observe holds no credential into your Palo Alto tenant, no API key, no read scope. The connection points inwards, which means the worst a compromised Token Observe deployment can do to that feed is stop receiving from it. That is both the shorter security review and the smaller blast radius, and it is the reason the integration was built this way rather than as an outbound API client. Two limits belong beside that. Deliveries are bounded — 10,000 records and 8 MB, refused whole rather than truncated — and a batch may lose up to 5 per cent of its records to unmappable rows, counted and reported, before the whole delivery is refused, because half not mapping is what a wrong mapping looks like rather than a dirty feed. And coverage travels with every surface that can report a clean result, so no caller can read zero findings without also being told which sources were silent when it said so. A dead feed must never be indistinguishable from a clean estate. - The receiver: A Palo Alto Strata Logging Service shape among six vendor-shaped receivers, alongside Cloudflare Logpush, Zscaler, Netskope, Elastic and Splunk, plus a generic shape for anything that can export on a timer. - What arrives: Evidence for the radar to reconcile against vendor bills, network egress, service-account keys, IDE and CLI telemetry, and Token Observe’s own caller and price consistency checks. - What does not arrive: Detection quality. A forwarded log tells Token Observe what Prisma AIRS found; it does not make Token Observe’s own nine patterns any better, and the documentation does not pretend it does. ## Choose Palo Alto Prisma AIRS when - Detection is the requirement: prompt injection, DLP, malicious code, contextual grounding and topic guardrails maintained by a threat-research organisation, rather than nine published heuristics. - You need coverage of the whole AI estate — inbound, outbound and east-west network traffic, agents built on SaaS platforms such as Microsoft Copilot Studio and ServiceNow — rather than of the agents that hold a credential you issued. - You want model scanning before deployment, red teaming against your own agents, or posture management, none of which Token Observe has or intends to build. - Your procurement process requires certifications and independent test results from the vendor. Token Observe holds none, and will say so on the first call. - You already run Palo Alto and the licence bundles services you are paying for anyway — Enterprise DLP, Strata Logging Service, Strata Cloud Manager — so a second contract for an overlapping control is a hard sell. ## Choose Token Observe when - The gap you have found is the action rather than the content: what the agent was permitted to do, who approved it, and whether it happened. - You need a human decision bound to one exact payload rather than to an action type — single-use, expiring, with the approver recorded against the trace and a changed argument refused as a mismatch. - Agent permissions must be action-level and deny-by-default with an explicit deny beating every allow, and delegation between agents must narrow authority rather than widen it. Palo Alto also sells agent identity, least-privileged access and Agent Endpoint rules for agent-to-agent calls, so compare the two on precedence and on delegation rather than assuming this is unique. - Somebody will eventually ask who says this record has not been edited, and a forwarded SIEM log is not an answer to that question. - Prompts, payloads and the management plane must all stay in your network, including for the control itself — that requires the customer-hosted Token Observe deployment. The cloud pilot holds workspace evidence and supplied credentials on the service. The customer-hosted licence is drafted to permit air-gapped operation, though it remains a template pending counsel. Palo Alto’s Hybrid AI Gateway also keeps gateway payloads in your cluster, managed from Strata Cloud Manager, so compare the two on where the console and the scan run. ## When you would run both Prisma AIRS stays where it is (Token Observe is built on the assumption that it will) and keeps doing what it is better at: the inline Network intercept across the estate Token Observe never sees, the maintained detection catalogue, model scanning before deployment, red teaming against your own agents, and posture management. Token Observe goes in front of the subset of agents that take actions somebody has to answer for, holding the deny-by-default action-level permission set, the delegation chain that intersects rather than unions, the approval bound to one exact payload and the hash-chained record. Agent identity, spend ceilings, rate limits and model allow-lists exist on both sides (Palo Alto’s AI Gateway scopes them to a workspace, an API key or an Admin API rule, Token Observe to one named agent), so decide deliberately which product owns each of those rather than configuring both and assuming they agree. The two connect in one direction only: you configure a log forwarding profile in Strata Cloud Manager pointing at a Token Observe receiver on a credential Token Observe issued, so Prisma AIRS findings become inputs to policy and to the shadow-AI radar without Token Observe holding any credential into your Palo Alto tenant. Start with the agents that can spend money or change state, leave everything else where it is, and decide explicitly which of the two sensitive-data scanners is authoritative for egress while the other runs in observe-only, because two redaction engines in series double the false-positive surface without doubling the protection. ## Questions and answers Q: Is Token Observe an alternative to Prisma AIRS? A: No, and the product’s own roadmap forbids selling it as one: a generic AI firewall, prompt scanner or red-team platform is named as a strategic non-goal, with the recorded consequence being to consume threat verdicts from platforms including Prisma AIRS rather than reproduce them. Prisma AIRS answers whether the content is malicious, across an estate that includes traffic no gateway sees, and its AI Gateway caps what a workspace or API key may spend and call. Token Observe answers whether the named agent was permitted to take this exact action, inside these ceilings, with which named person approving it. If you have to buy one first and detection is the gap, buy theirs. Q: We already run Prisma AIRS. What does Token Observe add? A: Less than the first draft of this page claimed. Palo Alto already sells agent identity and least-privileged access under Agent Security, and its AI Gateway documentation describes budget limits in USD or tokens, request rate limits per minute and per day, model allow- and deny-lists, and Agent Endpoint rules over what each registered agent may do, so spend caps, rate caps, model allow-lists and per-agent operation rules are an overlap. What Token Observe adds on top of a Prisma AIRS deployment is a deny-by-default action-level permission set where an explicit deny beats every allow, a delegation chain that intersects rather than unions so agent A cannot escalate through agent B, a human approval bound to the SHA-256 of the canonical action so a retry with one argument changed is refused as a mismatch, a kill switch scoped to one agent or the whole estate, and a hash-chained record of every decision that a third party can verify from an export. That layer is what bounds the damage of an injection the detection missed, which is a thing that will happen to any detector including a very good one. Q: Can Prisma AIRS verdicts drive Token Observe policy? A: Through the log path, yes, and that is the designed shape. The Prisma AIRS documentation describes AI security logs generated in Strata Logging Service and a log forwarding profile in Strata Cloud Manager that sends them to a destination you specify; Token Observe ships a Palo Alto Strata Logging Service receiver among six vendor-shaped receivers for its shadow-AI radar. You configure the forwarding in a console you already administer, delivering on a credential Token Observe issued, so Token Observe holds nothing into your Palo Alto tenant. What that gives you is reconciliation evidence rather than a synchronous policy input; if you need the verdict inline on the hot path, that is an integration to specify with both vendors rather than a feature to assume from this page. Q: Prisma AIRS scans prompts already. Why does Token Observe scan them too? A: Because a decision point that cannot see the payload cannot decide about it, and Token Observe’s decision at step 6 depends on data classes and an injection score as two of its seven trigger kinds. The scanning is deliberately modest and published with its numbers: nine weighted injection patterns scored 1.25 times higher when the text is a tool result, and eleven data classes of which three are checksum-validated, with confidence scores published per kind so a policy can set its own threshold. Free-text personal data is not detected at all. The product’s own wording is that this is a compensating control and not your only DLP. Where both products are deployed, pick one as authoritative for egress and run the other in observe-only. Q: Have you tested Prisma AIRS against Token Observe? A: No. Every claim on this page about Prisma AIRS is taken from Palo Alto’s own published pages, read on 5 October 2026 and listed in the sources, and none of it has been independently tested. There has been no witnessed bake-off against any product, and one is named in the product’s own launch gates as evidence that does not yet exist. Where a cell reads as an absence it uses the words “not described in their published documentation”, because an undocumented capability and a missing one look identical from outside, and Palo Alto publishes new Prisma AIRS features monthly — the June 2026 notes alone added Scan API rate limiting, multilingual adversarial testing and a privilege-misuse red-team category. Verify anything that decides your purchase with Palo Alto in writing. Q: What are the real limits of Token Observe against a platform like this one? A: Four. Its detection is heuristic (nine injection patterns and eleven data classes rather than a maintained detection service), and it sees only what routes through its gateway, so an agent that never presents a credential is a radar finding or nothing. It is a single-writer process on one host at this target scale, with no replica, no clustering and no vendor-operated uptime SLA, and it fails closed, so its availability becomes a property of your agents’ availability. Its audit chain is tamper-evident rather than tamper-proof, unkeyed by default, and its evidence exports are digest-sealed rather than signed. And it holds no SOC 2, no ISO 27001, no ISO 42001 and no independent penetration test; the licence permits a pre-purchase test by your own team, with findings publishable after coordinated disclosure, which is offered because the test does not yet exist.