Identity
Who may act?
Okta
Microsoft EntraAI security market landscape
The control point moves from intent to execution.
SmartVerify is the enterprise data security and compliance layer for AI, proving and controlling what agents do at execution.
Step 1 · The control landscape
Three complementary control categories
Who can act, how the agent runs, and what happens to enterprise data: different controls, complementary roles.
OktaMicrosoft EntraAI management / runtime security
How is the agent managed and protected?
Check Point / Lakera
Palo Alto Networks Prisma AIRS
SentinelOneData security
What happens to enterprise data?
CyeraMicrosoft Purview
Varonis
SmartVerifyRepresentative examples, not an exhaustive market map. Vendors can span categories. Logos identify vendors and do not imply endorsement.
Step 2 · Inside data security
Three questions inside data security
Discovery finds the data. Access control opens the door. Execution governance evaluates the action.
- 01
Where is the sensitive data?
Classification and DSPM
Find and label sensitive data.
CyeraVaronisMicrosoft Purview - 02
Who can connect and query?
Data access control
Set access for people and service accounts.
Immuta
Commvault (Satori)
Imperva (Thales) - THE EXECUTION LAYER
What did the agent read, for whom, and did it match the request?
Execution governance
Evaluate each read against the request.
SmartVerifyTool call+Query+Person
Representative examples; vendors may span multiple categories.
Step 3 · Compare the execution controls
Compare AI-focused data-access controls
Six controls around an AI-driven read. Specific capabilities—not an overall vendor ranking.
- Documented
- Scoped / adjacent
- Not a documented capability
| Control | SmartVerify | Formal | Immuta | Commvault (Satori) | Varonis | Imperva (Thales) |
|---|---|---|---|---|---|---|
| Inline enforcement | Inline | Protocol proxy | Platform-native | Real-time governance | Query blocking | Database blocking |
| Joined tool call, query and person | Joined record | Not a documented capability | Not a documented capability | Not a documented capability | Not a documented capability | Not a documented capability |
| Verified workload identity / no stored DB secrets | Short-lived identity | Not a documented capability | Not a documented capability | Not a documented capability | Not a documented capability | Not a documented capability |
| Result filtering and masking | PostgreSQL / MySQL | Mask / filter | Platform policies | Mask / redact | Remediation masking | Static masking |
| Signed, customer-held action evidence | Signed, customer-held | Not a documented capability | Not a documented capability | Not a documented capability | Not a documented capability | Not a documented capability |
| Per-action framework mapping | Per action | Not a documented capability | Not a documented capability | Not a documented capability | Not a documented capability | Not a documented capability |
SmartVerify
- Inline enforcement
- Inline
- Joined tool call, query and person
- Joined record
- Verified workload identity / no stored DB secrets
- Short-lived identity
- Result filtering and masking
- PostgreSQL / MySQL
- Signed, customer-held action evidence
- Signed, customer-held
- Per-action framework mapping
- Per action
Formal
- Inline enforcement
- Protocol proxy
- Joined tool call, query and person
- Not a documented capability
- Verified workload identity / no stored DB secrets
- Not a documented capability
- Result filtering and masking
- Mask / filter
- Signed, customer-held action evidence
- Not a documented capability
- Per-action framework mapping
- Not a documented capability
Immuta
- Inline enforcement
- Platform-native
- Joined tool call, query and person
- Not a documented capability
- Verified workload identity / no stored DB secrets
- Not a documented capability
- Result filtering and masking
- Platform policies
- Signed, customer-held action evidence
- Not a documented capability
- Per-action framework mapping
- Not a documented capability
Commvault (Satori)
- Inline enforcement
- Real-time governance
- Joined tool call, query and person
- Not a documented capability
- Verified workload identity / no stored DB secrets
- Not a documented capability
- Result filtering and masking
- Mask / redact
- Signed, customer-held action evidence
- Not a documented capability
- Per-action framework mapping
- Not a documented capability
Varonis
- Inline enforcement
- Query blocking
- Joined tool call, query and person
- Not a documented capability
- Verified workload identity / no stored DB secrets
- Not a documented capability
- Result filtering and masking
- Remediation masking
- Signed, customer-held action evidence
- Not a documented capability
- Per-action framework mapping
- Not a documented capability
Imperva (Thales)
- Inline enforcement
- Database blocking
- Joined tool call, query and person
- Not a documented capability
- Verified workload identity / no stored DB secrets
- Not a documented capability
- Result filtering and masking
- Static masking
- Signed, customer-held action evidence
- Not a documented capability
- Per-action framework mapping
- Not a documented capability
“Not a documented capability” means it was not established in the reviewed material—not that the vendor lacks it.
How it works
A signed record at the point of execution
See the statement, returned rows, columns read, session, and agent identity. Retention is configurable, and longer periods with an immutable export are available for estates with a mandated retention period.
10:23:45.123REQUESTAnalytics-Agent
SELECT name, email, ssn FROM customers WHERE region = 'WEST'10:23:45.124LABELED
PII: name PII: email SSN: ssn
10:23:45.125RESPONSERECORDED
3 rows returned; columns: name, email, ssnCapabilities
Start with evidence. Extend into control.
RecordAvailable now
Join the person, agent, tool call, query as executed, and returned data in one signed entry per action, stored in the customer's account. Retention is configurable, and longer periods with an immutable export are available for estates with a mandated retention period.
RefuseAvailable now
Refuse a query or tool call that breaks customer policy before it reaches the data or tool server. The agent receives an error its framework already handles.
ReshapeAvailable now
Apply policy to returned data so the agent receives only the rows and fields the request permits. Available on PostgreSQL and MySQL; S3 and DynamoDB reshaping are on the roadmap.
LimitAvailable now
Cap records per query and tool calls per agent and per person. Customers define the policy limits and counting windows. Behavior-based cumulative limits are on the roadmap.
Record and Refuse are available on PostgreSQL (including Amazon RDS and Aurora), MySQL, Amazon S3, Amazon DynamoDB, MCP and JSON-RPC. Reshape is available on PostgreSQL and MySQL. Reason across sessions, behavior-based cumulative limits, and Reshape for S3 and DynamoDB are on the roadmap.
What we cover today, and what is being built
Source
What we can observe
Whether we can refuse an action
PostgreSQL, including Amazon RDS and Aurora
ObserveAvailable now
The statement as executed, the rows returned, the columns read. Retention is configurable, and longer periods with an immutable export are available for estates with a mandated retention period.
Refuse
Available now
Connect as a role with no write privileges, so the database itself refuses every write
Available now
Refuse an individual statement by kind, target table, column or value
MCP and JSON-RPC tool calls
ObserveAvailable now
The tool invoked, the arguments given, the call as forwarded onward.
RefuseAvailable now
Refuse a tool call before the tool server acts on it. The answer is a typed error the agent framework already expects.
MySQL
ObserveAvailable now
Record the executed query and returned data.
RefuseAvailable now
Decline queries that break customer policy.
MongoDB
ObserveOn the roadmap
Wire level inspection.
RefuseOn the roadmap
Snowflake and other warehouses reached over HTTPS
ObserveOn the roadmap
Web API traffic uses a separate interception model from database-protocol traffic.
RefuseOn the roadmap
Vector stores and RAG pipelines
ObserveOn the roadmap
Query and retrieval inspection.
RefuseOn the roadmap
Amazon S3
ObserveAvailable now
The operation, the bucket, the object key, the size and the calling agent. Object contents are forwarded untouched and are not inspected.
RefuseAvailable now
Decline an operation before it reaches the bucket.
Amazon DynamoDB
ObserveAvailable now
The operation, the table, the key and the calling agent.
RefuseAvailable now
Decline an operation before it reaches the table.
Azure Blob Storage
ObserveOn the roadmap
As for S3. Azure authorizes differently, so this is separate work rather than the same work.
RefuseOn the roadmap
Decline an operation before it reaches the container.
For roadmap data sources reached through a supported tool server, the tool-call interceptor can record the call, target and arguments. This does not imply native data-source or response inspection. Reshape is available on PostgreSQL and MySQL; S3 and DynamoDB reshaping remain on the roadmap.
Available nowmeans it is running in customer environments today.
In design partner buildmeans the capability is being built with a small number of named customers. Additional design partners can still participate.
On the roadmapmeans it is planned and not yet started.
What a first deployment looks like
Available now
Start in record-only mode with interceptors at the tool server and data store. Review the joined records, define customer policy, then enable refusal, reshaping and limits in stages. Single-interceptor deployment remains supported when only data-path evidence is needed. Runs inside your environment on AWS, Azure, Google Cloud, on premises or air-gapped, without application-code changes.
Developer guides
Implement against the interfaces you already use.
What you get back
In design partner build
A report on your own agent traffic, in two parts: what SmartVerify refused, and what SmartVerify recorded but was not configured to refuse. It also states the share of traffic that could not be classified.