The measured gap
Prompt to execution drift
Upstream controls see the request before execution. They cannot establish which statement the tool server ultimately sent to the database or what the database returned. The difference between the request and the database event is what SmartVerify measures.
Why checking the tool call is not enough
A tool call can be checked against a schema. That catches a call to a tool the agent should not be using, or an argument of the wrong type, and it is worth doing. What it cannot catch is the effect of a call that is entirely valid.
A request for a customer report with the region set to all is schema valid. So is a search with an empty query string, or an export with a limit of nine hundred thousand. Each one passes every check and each one can return the whole table. The consequence cannot be established from the tool call alone. It becomes measurable where the statement executes and the result returns.
Checking the request and bounding the consequence are two different jobs, done in two different places.
Evidence
The execution record is the evidence.
record sv_01J8F2K9QX4M observed 2026-08-19T14:02:17.443Z agent agent-billing-assistant platform: entra-agent-id session sess_7f3a9c chain position 41 of 41 statement SELECT id, name, ssn, dob, plan_id FROM members WHERE region = $1 parameters $1 = 'WEST' returned 40247 rows columns id name [PII] ssn [SENSITIVE] dob [PII] plan_id policy allowed, flagged: result set above session threshold signature ed25519 verified chain intact
Synthetic example with illustrative field names and values.
The record shows the statement as executed, the returned row count, and the columns read. Security, Legal, and Risk teams use that evidence to judge whether the action was appropriate.
One worker or two observation points
Every deployment includes an inline edge worker on the data path in front of PostgreSQL. When the deployment topology exposes the agent-to-tool connection, a second interceptor joins the agent-side record to the database execution record.
Standalone
One inline edge worker
Runs inside your VPC on the connection in front of the database. It records the statement as executed, returned row count, and columns read.
Topology-dependent
Two inline observation points
A second interceptor on the agent-to-tool connection adds the agent-side record and joins it to the data-path record.
Where this shows up in practice
Incident scoping.
Use the executed statement, returned row count, and columns read to bound what data was reached.
Vendor and customer assurance.
Use a signed data-path record to answer what an agent touched inside customer data.
Internal approval.
Give Security, Legal, and Risk teams execution evidence for production-access decisions.