---
title: "Orca's 93% token reduction makes schema selection a security control"
description: "Orca Security's Bedrock query agent cuts tokens by narrowing a 900-model schema. The real production safeguard is validated, authorised, traceable query execution."
url: "https://devencelab.com/insights/2026/10/13/orcas-93-token-reduction-makes-schema-selection-a-security"
date: "2026-10-13"
section: "Insights"
tag: "AI Security"
author: "Devence Lab"
reading_time: "3 min read"
site: "Devence Lab"
license: "Readable and quotable with attribution to the canonical URL."
---

# Orca's 93% token reduction makes schema selection a security control

Orca Security's Bedrock query agent cuts tokens by narrowing a 900-model schema. The real production safeguard is validated, authorised, traceable query execution.

Orca Security reported on 13 October 2026 that its Bedrock-based Discovery AI reduced input tokens by 93%, query cost by 90% and end-to-end latency by 75% compared with its first design. The initial approach put more than 900 cloud-resource models into a large prompt. The replacement selects just the schemas relevant to the analyst's question. This is a useful result, but token savings are only half the architectural lesson.

Orca's Sonar query system spans over 900 resource models and 18 operators. A natural-language interface must translate an analyst's intent into valid structured filters without inventing fields, relationships or permissions. Smaller context can improve speed, yet also changes which evidence the generator is allowed to see.

## The retrieval boundary determines what the model may express

The published nine-stage pipeline starts with context and deterministic matching for identifiers such as IP addresses and CVEs. It screens requests, retrieves 20 candidate examples using embeddings, reranks them to five and selects relevant model schemas before generating a filter. A static checker and the Sonar API then validate the result. AWS reports that different models handle distinct stages rather than one frontier model doing everything.

That design replaces a huge ambiguous prompt with smaller explicit interfaces. For defenders building similar systems, schema selection should be observable: record selected resource models, example identifiers, request context, rejected fields and validator errors. When the wrong model is chosen, a syntactically valid query can still miss relevant assets.

> The safest natural-language query is not the one that sounds plausible; it is the one whose schema, scope and execution can be independently checked.

## Validation does not grant authorisation

The account describes guardrail checks for unsupported requests and prompt injection, followed by static and API-backed filter validation. Neither should be mistaken for a user's permission to read every matching resource. The execution layer must still enforce tenant scope, role permissions and audit logging independently of the generated query.

Build negative tests around queries that span accounts, request sensitive fields, refer to nonexistent relationships or include adversarial instructions in retrieved examples. Distinguish blocked requests from invalid generated filters and permission denials. Preserve enough structured trace data to reconstruct why a query returned an empty or unexpectedly broad result.

## Optimisation requires a domain-specific regression set

AWS says the revised workload fell from roughly two million to 140,000 input tokens and from about 60 seconds to 15 seconds. Those figures describe Orca's reported baseline comparison, not a guarantee for other enterprises. Its team uses an evaluation harness and domain-expert labels to monitor correctness, completeness and query-equivalence over time.

A production acceptance test should compare generated filters against expert-approved queries for the same identities and cloud inventories. Measure false omissions, excessive result scope, human correction time, validator retries, cost per accepted query and response latency. Roll back schema selection changes when quality slips. Orca's case illustrates that constrained context can be both cheaper and more dependable, provided the constraints themselves remain accountable.

Produced through Devence Lab's automated research and publishing workflow, without prepublication human review. Devence Lab retains editorial responsibility. Sources are linked; report factual errors to contact@devencelab.com.

## Sources

- [Natural language security queries at Orca Security using Amazon Bedrock](https://aws.amazon.com/blogs/machine-learning/natural-language-security-queries-at-orca-security-using-amazon-bedrock/) - AWS Machine Learning Blog