Know what AI agents actually did with your data.
SmartVerify records AI at the point of execution, creating signed evidence of the statement that ran and the data it returned.
Agent platform
Records what the agent reported.
SmartVerify
Records what the database executed and returned.
No application code changes. Deploys inside your VPC. See Platform for coverage.
Proud member companyThe data checkpoint
A boarding pass tells you who may enter.
An X-ray shows what passes through.
Identity and access tools establish who may act. Agent platforms record what the agent reported. SmartVerify records the database execution.
Identity and access
Identity check and boarding pass
Establish who may enter, where they may go, and what they are authorized to do.
SmartVerify
The X-ray at the data checkpoint
Record the executed PostgreSQL statement, returned row count, and columns read on the data path.
Standalone data-path deployment
One inline edge worker
Runs inside your VPC on the connection in front of the database and creates the execution record.
Topology-dependent deployment
Two inline observation points
Adds agent-to-tool context so the claim can be related to the database event.
Agent platforms record the claim. SmartVerify records the execution.
Prompt to execution drift is the gap between what the agent was asked to do and the statement that actually ran. SmartVerify's inline edge worker runs inside your VPC on the data path and creates a useful database execution record on its own.
SmartVerify always sits at the query, between the tool server and the database, where the statement actually runs. When the deployment topology exposes the agent-to-tool connection, a second SmartVerify interceptor records the tool call and joins it to the database event.
Holding both records for a single event is what produces the comparison. The tool server reports twelve records. The wire says forty thousand two hundred and forty seven rows across thirty one columns, including social security number. Neither record contains that comparison on its own, and no product that observes a single point on the path can produce it.
Complementary controls
Where prompt guarding ends
A prompt gate lowers the chance of a bad request being made. It cannot tell you what a bad request did, because by the time the model has written a statement, the gate is no longer in the path. The two controls answer different questions. They lower the probability. We bound the consequence, and we record it.
Built by the team that built, operated and scaled security and compliance services at AWS
From evidence to control
Start with the record. Extend into control.
PostgreSQL Record, MCP and JSON-RPC Observe and Refuse, and PostgreSQL role-based write refusal are available now. Individual PostgreSQL statement refusal is in design partner build, and Reshape is on the roadmap. See the Platform coverage grid for source and phase coverage.
RecordAvailable now
A signed evidence record of the statement as executed, the number of rows returned, the columns read with sensitivity labels, the session, and the agent identity. Retention is configurable, and longer periods with an immutable export are available for estates with a mandated retention period. Record for PostgreSQL is available now. See the Platform coverage grid for source availability.
RefuseAvailable now
Stop an action before it takes effect. MCP and JSON-RPC tool-call refusal is available now. PostgreSQL write refusal through a role with no write privileges is available now. Refusing an individual PostgreSQL statement by kind, target table, column, or value is in design partner build. Because the decision is made on the request, nothing is forwarded, so there is no partial effect and nothing to roll back.
ReshapeOn the roadmap
A future response-path phase for masking, tokenisation, and redaction of returned data. Reshape is not available today.
ReasonOn the roadmap
A future phase for comparing requests against an agent's established pattern of behaviour and surfacing patterns across many sessions. Reason is not available today.
PostgreSQL Record, MCP and JSON-RPC Observe and Refuse, and PostgreSQL role-based write refusal are available now. Individual PostgreSQL statement refusal is in design partner build. Reshape and Reason are on the roadmap. The Platform coverage grid is authoritative for source availability.
Three layers, three questions
Where SmartVerify fits
An airport identity check and boarding pass establish who may enter. SmartVerify is the X-ray at the data checkpoint. Its inline edge worker records the executed statement, returned row count, and columns read instead of relying on what the agent reported.
| Layer | Question it answers | Record it creates |
|---|---|---|
| Identity and access | Who may act? | Identity, entitlement, and authorization event |
| Agent platform | What did the agent report? | Tool call, arguments, and reported result |
| SmartVerify | What executed and returned? | Statement, returned rows, columns read, and signed session record |
Identity and access
Who may act?
Identity, entitlement, and authorization event
Agent platform
What did the agent report?
Tool call, arguments, and reported result
SmartVerify
What executed and returned?
Statement, returned rows, columns read, and signed session record
Each layer creates a different record. The Platform coverage grid is the source of truth for availability.
Model Context Protocol
Where MCP fits
Agents reach data through tool calls, and the tool server then reaches the database. PostgreSQL execution observation is available now on the database connection, where the query, returned row count, and column list exist. Direct MCP and JSON-RPC observation and tool-call refusal are available now on the agent-to-tool connection.
MCP and JSON-RPC observationIn design partner build
Records the tool invoked, its arguments, and the call forwarded onward.
Behavioural baseliningOn the roadmap
Compares requests with the agent's established pattern of behaviour.
Inline deploymentIn design partner build
Places the inline edge worker on the network path inside your VPC without changes to MCP servers or clients.