Head-to-head · updated 13 September 2026

DataShield vs Bedrock AgentCore: who proves the tool call was allowed?

Let's start with the part some vendors get wrong. Bedrock AgentCore really does authorize each tool call. AgentCore Policy went generally available on 3 March 2026, and the Gateway evaluates a Cedar decision against the JWT claims and the tool's own arguments before the tool runs. If you already build on AWS, it's a good agent platform, and the CloudWatch dashboards are right where your team expects them.

We sell the layer underneath that decision. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed call gets a scope ceiling, an authority tier, and a live revocation check, then lands in a hash chain you can verify without trusting us. Most teams should run both. Below is where each one actually earns its keep, sources included.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Someone will one day ask you to prove an agent's access log wasn't edited. CloudWatch can answer what happened. It can't answer that. Run the verifier.
You need to pull an agent's authority mid-session and have the next tool call fail. AgentCore sessions can run eight hours. That's a long time to wait for a token to expire.
Your agents touch PHI or regulated PII, and you'd rather they queried tokens than raw fields. See how the ontology maps it.
Part of the estate isn't on AWS. Ours runs on your own infrastructure, on your tin, with your keys.

Pick Bedrock AgentCore when

You're an AWS shop and want the whole agent platform on one bill: Runtime, Memory, Gateway, Browser, Code Interpreter, Evaluations, Agent Registry.
You want policies written in plain English that compile to Cedar, so a risk manager can read them without learning a policy language.
You need temporal rules over a session. Pass a policy session id and Cedar can judge the accumulated chain of actions, not just the call in front of it. We don't do that yet.
Your policies need to gate on argument values. AgentCore's own example denies a refund over $500 straight from the tool input.

Bottom line: AgentCore governs the pipe. DataShield governs the data and keeps the proof. If your agents live on AWS, run both: point AgentCore Gateway at our MCP surface and let each layer do its job.

Feature by feature

Competitor cells describe what AWS's public site and docs say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.

What matters	DataShield	Bedrock AgentCore	Edge
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier.	Observability writes spans, logs, and metrics to CloudWatch, in OpenTelemetry format. Built for tracing and debugging. We found no published tamper evidence.	◆
Agent authorization	Every governed tool call passes a scope ceiling, a declared authority tier, and a revocation re-check before dispatch. Cedar covers admin, config, and token decisions.	AgentCore Policy evaluates a Cedar decision at the Gateway on every agent-to-tool request, using JWT claims and the tool arguments. Default deny. Generally available since March 2026.	◈
Mid-session revocation	Revoke or suspend an agent and the very next governed call fails. No waiting for expiry.	Policy can deny a call, but we found no way to kill an already-issued token before it expires. Sessions run up to eight hours.	◆
Scope ceiling on delegated tokens	Auth-issued MCP tool tokens carry a ceiling the delegated token cannot exceed, even when the upstream authorization server granted more.	Identity vaults refresh tokens and does OAuth on behalf of a user. Nothing documented shrinks a granted token below what the issuer allowed.	◆
Break-glass	Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly deleted from the log.	Not described in the docs we read.	◆
GDPR erasure	Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor ids are HMAC-committed, so the chain still verifies after erasure.	Standard AWS data deletion and retention controls. Interaction between erasure and agent audit history isn't documented.	◆
Sensitive data handling	Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Plus PII and PHI classification and quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column.	Bedrock Guardrails masks PII in prompts and model responses, but AWS documents that it does not evaluate tool call arguments, tool results, or tool definitions. See the FAQ.	◆
Policy authoring	Cedar policies with policy_explain and entitlement expansion, written by an engineer.	Natural language authoring that compiles to Cedar, plus temporal rules that judge a session's accumulated action chain. Nice work, and we don't match it.	◇
Agent platform breadth	We're not a runtime. Bring your own agents and frameworks; we govern the data and the calls.	Runtime, Memory, Browser, Code Interpreter, Web Search, Evaluations, Optimization, Agent Registry, and wallet-backed Payments.	◇
MCP and agents	Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens with scope ceilings; per-call metering attributed to the agent.	Gateway fronts MCP servers and REST tools, indexes them, and routes agent traffic. Strong MCP support.	◈
Deployment	Self-hosted or dedicated single-tenant. Any cloud or none. Your keys.	AWS only. Framework-neutral and model-neutral, cloud-locked. Thirteen regions for Policy, nine for the GA launch.	◆
Maturity signals	Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so.	AWS. Generally available since 13 October 2025, with Cox Automotive, Druva, and Thomson Reuters on the record. Every compliance programme you can name.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Published per-unit rates. Policy costs $0.000025 per authorization request; Gateway is $0.005 per 1,000 API invocations. Cheap, and visible without a call.	◈

◆ DataShield leads◇ Bedrock AgentCore leads◈ comparable

AgentCore claims are drawn from aws.amazon.com and AWS documentation, last checked 13 September 2026. We link them below rather than paraphrase from memory.

Three things you get here that you won't get from an agent platform

Proof, not telemetry

A trace tells your on-call engineer what the agent did. It doesn't tell a regulator that nobody edited the record afterwards. Ours is a hash chain with signed checkpoints, and the verifier names what went wrong. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Authority that can change mid-flight

An analyst quits at 2pm. Their agent is 20 minutes into a long job on an eight-hour session. Our next governed call re-checks current authority and fails closed. A policy decision alone can't help if the token is still valid and the policy still says yes. How Auth does it.

Tokens where the PII used to be

Authorization decides what an agent may do. It says nothing about what the agent can reach. Tokenize the sensitive fields at ingest and a hijacked agent finds TOK_ strings, not patient names. The mapping lives in the ontology; the key custody story is on the security page.

Where Bedrock AgentCore is genuinely stronger

AgentCore is the best-funded agent platform in the market and it shows. The Gateway fronts your MCP servers and REST tools and routes agent traffic through one governed door. Policy compiles plain-English rules into Cedar so a risk manager can read them, applies default deny per request, and can gate on the tool's actual arguments rather than just the tool name. Temporal rules go further still: hand the Gateway a policy session id and Cedar judges the accumulated chain of actions in that session. We don't ship that, and I'd rather say so than pretend the gap runs the other way. Add Runtime, Memory, Evaluations and an agent registry, on an AWS bill your finance team already approves, and the pull is obvious.

Here's the push-back. All of that governs the request. None of it changes what's in the response, and none of it makes the record of the decision hard to alter. AWS's own Guardrails documentation says the sensitive-information filter doesn't evaluate PII the model writes into tool call arguments, PII in the tool results your application hands back, or PII in the tool definitions themselves. Their example is an email address passed to a file-writing tool: not masked. So the data path stays raw unless you fix it at the source. Do that with tokenization, seal each decision into evidence, and AgentCore's per-call decision becomes something you can defend two years later.

Questions worth asking both of us

These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification tells deletion from truncation from tampering. Run it at /verify. AgentCore: Observability stores spans, logs, and metrics in CloudWatch. We found no published tamper-evidence mechanism for that data. Ask AWS what stops a log group being shortened or dropped, and what you'd show an examiner.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation bites on the next call. AgentCore does evaluate policy per request at the Gateway, so if you can edit the policy fast enough the next call is denied. What we couldn't find is a way to revoke an already-issued token before expiry, and AgentCore sessions can run eight hours. Ask how long a compromised agent keeps working after you pull its access.

Does Bedrock Guardrails mask PII inside tool calls?

No, and AWS says so plainly. The docs state the sensitive-information filter evaluates text content only, and in tool-use workloads it does not evaluate PII the model generates into tool call arguments, PII in tool results returned to the model, or PII in your tool definitions. Their own example: an email address passed to a file-writing tool isn't masked. That's the gap tokenization at ingest closes, because the value the agent handles was never the real one.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so evidence stays verifiable after the subject is gone. For AgentCore we found retention and deletion controls at the AWS service level, but nothing describing what erasing a person does to agent audit history. Ask whether erasing a subject breaks the record you'd rely on.

If we run both, what stops an agent going around DataShield?

The same thing that stops it going around the Gateway: you don't give it another door. Point AgentCore Gateway at our MCP endpoints, keep credentials for the underlying systems in the Connection Vault rather than in the agent, and network-block direct paths. Two enforcement points beat one, and they fail in different ways, which is the point.

Does DataShield have SOC 2?

Not yet, and we won't imply otherwise. You're comparing a young product from a small team against AWS, so weigh that honestly. Auth is live a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow so a small vendor isn't a single point of failure. Details on the security page.

AgentCore's positioning: "The platform for production AI agents. Any framework. Any model. Secure at scale." — aws.amazon.com/bedrock/agentcore, 13 Sep 2026
AgentCore reached general availability on 13 October 2025, with eight-hour execution windows and session isolation. — AWS What's New, 13 Oct 2025
AgentCore Policy became generally available on 3 March 2026: natural-language policies compiled to Cedar, evaluated at the Gateway before a tool runs. — AWS What's New, 3 Mar 2026
Bedrock Guardrails sensitive-information filters "evaluate text content only" and in tool-use workloads do not evaluate PII in tool call arguments, tool results, or tool definitions. — AWS Bedrock user guide, 13 Sep 2026
AgentCore Observability stores metrics, spans, and logs in Amazon CloudWatch for tracing and debugging. — AgentCore developer guide, 13 Sep 2026
Published AgentCore rates: Policy $0.000025 per authorization request; Gateway $0.005 per 1,000 API invocations. — aws.amazon.com/bedrock/agentcore/pricing, 13 Sep 2026

Other head-to-heads

Gateways

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →