Comparison
Four complementary layers.
Four different records.
Prompt guardrails evaluate requests. Identity and IAM establish who may act. DSPM maps data posture. SmartVerify records observed PostgreSQL execution and results. This matrix shows where each layer establishes evidence without treating one as a replacement for another.
| Comparison | Prompt guardrails Request layer | Identity and IAM Access layer | DSPM Posture layer | SmartVerify Execution layer |
|---|---|---|---|---|
| Evidence produced | A record of the prompt or request evaluated and the guardrail decision. | Authentication, authorization, role, policy, and access-decision records. | Inventory, classification, exposure, and posture findings for data at rest. | One signed record per action joining the person, agent, tool call, executed query and returned data, stored in the customer's account. |
| Enforcement point | At the model or application request boundary. | At sign-in, token issuance, and resource authorization boundaries. | At the data-posture and remediation workflow layer. | Inside the customer's environment at the tool server and data store. |
| Timing | Before or during model and tool-request handling. | When identity and access decisions are made. | When posture discovery, scanning, or assessment runs. | On each tool call and data operation, with result controls on PostgreSQL and MySQL. |
| Current product availability | Varies by the selected product and deployment. Confirm with the provider. | Varies by the selected IAM product and deployment. Confirm with the provider. | Varies by the selected DSPM product and deployment. Confirm with the provider. | Record and Refuse cover PostgreSQL, MySQL, S3, DynamoDB, MCP and JSON-RPC. Reshape covers PostgreSQL and MySQL. See the Platform coverage grid for current source and control availability. |
Use each layer for the question it can answer
Prompt guardrails can lower the probability of a bad request. Identity and IAM govern access. DSPM establishes posture. SmartVerify bounds and records the execution consequence on observed PostgreSQL connections, with zero application code changes.
Keep identity, prompt, and posture controls for their established boundaries
Add SmartVerify for signed PostgreSQL execution records
Bring the complementary records into investigation and review workflows