Smartflow vs. Runlayer: Operating Layer vs. Request Path

Runlayer calls itself "the operating layer for AI": an MCP gateway, a connector catalog, agent accounts, runtime scanners and shadow AI discovery across the AI clients employees already use, hosted by Runlayer or self-hosted in your own AWS account or Kubernetes cluster. Smartflow is a control plane on the request path, enforcing policy inline on every model call and MCP tool call routed through it, on your own infrastructure, including air-gapped. Both give agents an identity of their own, and both can pause a risky call for a person. They diverge on where the control plane can run, who approves, and what the record is built to prove.

The short version

Runlayer began as enterprise MCP infrastructure and now covers company-wide AI rollout: approved connectors, agent accounts, ToolGuard and AgentGuard scanning, endpoint discovery through MDM, and an LLM gateway in early access. It raised a $30M Series A in June 2026, bringing total funding to $42M, and its changelog lists more than a dozen releases in the two weeks to November 6. Anyone evaluating MCP governance should have it on the list.

The differences that decide it are narrow: whether the control plane can run with no egress, who may approve a paused action, and whether the record is built for an examiner.

Feature Comparison

Where the control plane can run

Runlayer documents two models. In the hosted model, Runlayer runs a single-tenant deployment in an AWS account it operates. In the self-hosted model, the customer deploys into its own AWS account on ECS with Terraform, or onto an EKS or GKE cluster with the Runlayer Operator, and applies updates on its own schedule. In Runlayer's words, "data never leaves your infrastructure." For an enterprise that wants governed traffic inside its own cloud account, that answers the residency question.

Runlayer's egress page sets the boundary. Its "Core platform (always)" list for a self-hosted deployment includes WorkOS for SSO, Runlayer's MCP catalog API, and a Runlayer host for "Feature flag, entitlement, and licensing configuration." The networking guide adds that "Private ALBs and PrivateLink do not remove outbound requirements." The deployment guides cover AWS, EKS and GKE and describe no install that runs without that egress. Runlayer's architecture page lists a Hybrid Cloud reference architecture for "On-premises and cloud integration," with design documents from its architecture team.

For most buyers that is detail. For a defense program inside an accredited enclave, or a bank whose model-risk perimeter permits no egress at request time, it is the whole question. Smartflow runs on-premises and air-gapped. Configured with local embeddings and a local model, policy, cache and audit make no call to us or anyone else.

Who approves, and what the record shows

Both products can stop a risky call and wait for a person. They differ on who that person is.

Runlayer's human approval rules, in beta, add "a human checkpoint on top of access a permission policy already granted." The approver is the person the agent acts for. Runlayer's docs say requests cannot yet be routed to an admin, a group or a backup approver. The request arrives by Slack or link, a pending request lives 24 hours, and an approval lets the identical call through once within an hour. A standalone agent account acts with no user behind it, and its calls cannot be approved today.

In Smartflow, the paused action is an approval ticket: pending until someone with approval rights approves or denies it, redeemed once when the action runs, and expired after 24 hours. With step-up, set per action, the approver re-verifies their identity before the approval counts, and the record shows who decided. A firm that separates duties should ask each vendor who has approval rights and how the approver's identity is checked at the moment of approval.

Runlayer is strong on the record. A call made with an agent account's token is "logged with the agent account as the actor," and on a delegated call the same row names the user. Logs are archived to S3 after a 90-day default window rather than deleted, and can be exported continuously to S3 for SIEM ingestion. Smartflow's records are hash-chained, carry RFC 3161 timestamps from a public timestamp authority or the customer's own, and are written to the customer's SIEM, with an optional write-once archive in the customer's account. Ask each vendor to show how a third party verifies a single record.

The AI client and the model path

Runlayer centers on the AI client on the employee's machine. It pushes configuration through Jamf, Intune and other MDM tools, and it finds unmanaged MCP servers and plugins on managed devices. It can deny a Claude Code tool call before it runs, or mask part of a tool's output before the model sees it.

Smartflow centers on the request path. Model calls and MCP tool calls pass through it, and it routes, fails over and caches on the same path that enforces policy. The trade is that a call has to be pointed at the gateway. Runlayer's LLM gateway is in early access. Its agent framework guides route tool calls through Runlayer, while the code examples call the model provider directly. Where the risk sits in the prompt and the response as well as the tool call, ask each vendor where every call goes.

Where Runlayer is strong

Agent identity is where Runlayer comes closest to Smartflow, and it is well built. An agent account is its own principal, with machine-to-machine tokens, on-behalf-of tokens minted by RFC 8693 token exchange, optional DPoP sender-constrained tokens, revocation checked on every request, and an accountable owner. On a delegated call, Runlayer enforces the intersection of the agent's policies, the user's policies and server-level policies.

The MCP depth reflects where the company started. Runlayer ships a connector catalog, admin approval for new servers, custom MCP hosting and an OAuth broker. Policy reaches down to the tool and resource with default deny. Tool List Guard scans tool definitions at registration, and a protocol lets security teams add custom scanners. Rollout reaches 20+ AI clients through the MDM tools IT already runs.

Runlayer lists SOC 2, HIPAA and GDPR compliance and reports AARM Extended Conformance. It reports being named an AI Security Endpoint Leader in Latio's 2026 AI Security Market Report. Consider a company putting Claude Code, Cursor and Codex in front of every team, where security needs one approved path with an audit trail behind it. For that company, Runlayer is a strong and fast answer.

When to choose Smartflow

• On-premises or air-gapped: the control plane runs in your data center or enclave, and configured with local embeddings and a local model, policy, cache and audit make no call to us or anyone else
• Approval rights, re-verified: the paused action waits for someone with approval rights, step-up re-verifies the approver per action, and the record shows who decided
• The model path itself: routing, failover and caching across model providers on the same gateway that enforces policy
• Examination evidence: packages and model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act, generated from enforcement records

Common questions

Can Runlayer be self-hosted? Yes. It runs in your own AWS account on ECS, or on EKS or GKE with the Runlayer Operator. Self-hosted deployments keep outbound HTTPS to WorkOS and to Runlayer's catalog and licensing hosts. A disconnected install is not documented.

Does Runlayer give agents their own identity? Yes. An agent account is its own principal, with its own credentials, tokens, policies and owner.

Who approves a risky tool call in Runlayer? Under human approval rules, which are in beta, the person the call runs for approves it, through Slack or a link. Calls from standalone agent accounts cannot be approved today.

Does Runlayer govern model calls? Its LLM gateway, in early access, sets per-model spend limits and can route to a cheaper model when a budget runs out. Response caching is not documented. For a Claude Enterprise organization, Anthropic's inference hooks, an Anthropic beta, send each governed Claude prompt to Runlayer for an allow or deny verdict before inference.

Which frameworks does Runlayer document? Runlayer lists SOC 2, HIPAA and GDPR compliance for its platform and reports AARM Extended Conformance. Mappings to FINRA, SOX, NIST AI RMF or the EU AI Act are not documented.

Related reading

MCP security · Model Context Protocol · AIDA agent identity guide · Step-up approval for AI agents · Air-gapped AI deployment · Tamper-evident audit log · Examination readiness · Tool poisoning · Smartflow vs. Aurascape · All comparisons

Verified against each vendor's published documentation in November 2026. Vendor capabilities change. If something here is out of date, tell us and we will correct it.

Runlayer sources: runlayer.com and its platform, mcp-gateway, guard, identity-policy, visibility, about, integrations/clients/claude-code and llms.txt pages; docs.runlayer.com deployment overview, egress requirements, Kubernetes prerequisites, Runlayer Operator, ECS networking, shared responsibility, architecture, policies, approvals, agent accounts, audit logs, sessions, ToolGuard, custom scanners, LLM gateway, Anthropic Inference hooks, agent frameworks and changelog; and the runlayer.com/blog posts of November 17, 2025 ($11M raise), April 15, 2026 (AARM), June 24, 2026 (Series A), September 15, 2026 (Latio) and October 8, 2026 (AI spend and ROI).