From Outsourced Human Workers to AI Agents: Why We Built RedactSure

The problem we started with

An outsourced support representative opens a customer's account to move a payment date. The screen shows the name, the address, the date of birth, the card on file and the notes from the last call. The task needs almost none of it, yet the representative sees all of it, on every account, all day. A payroll processing center has the same shape: a clerk keying a pay change sees every employee's Social Security number and bank account on the way.

The rules already point at the gap. For payment cards, the PCI Security Standards Council says that if sensitive authentication data, such as a card verification code, "is collected during a call, every effort must be made to prevent the data from being recorded" (PCI SSC, FAQ 1210). In healthcare, HIPAA asks covered entities to "limit protected health information to the minimum necessary to accomplish the intended purpose" (45 CFR 164.502). This means the people doing the work should hold as little sensitive data as the work allows.

People with access are also the people attackers go after. In 2025, Coinbase disclosed that criminals had paid "multiple contractors or employees working in support roles outside the United States" to collect customer information from internal systems they could already reach, and put the cost at "approximately $180 million to $400 million" (Coinbase, Form 8-K, 2025). CISA's advisory on the Scattered Spider group describes actors who "Posed as company IT and/or helpdesk staff using phone calls or SMS messages to obtain credentials from employees and gain access to the network" (CISA, AA23-320A). Training helps, but it does not change what is on the screen once someone is in.

What we designed

Charles Curt, our co-founder, built the first version for outsourcing workers who see personal information, in call centers, customer support centers, payroll processing centers and other operations centers. His answer was to change the screen rather than the person. The worker operates the organization's own applications inside a governed environment that RedactSure controls. Before anything is displayed, values chosen by policy are replaced with consistent tokens. The customer appears as CUST_001, the account as ACCT_001 and the card as CARD_001, and the same token follows the same value across every application in the session.

Consistency is what keeps the work possible. A representative can match a customer to an account, see that the account in billing is the account in the CRM, and complete the update, all without reading the real number. Where a task needs a real value, such as a payment processor that must receive the card, the value is released at that approved destination and not on the screen. We call the principle Least Exposure: each worker sees what the task requires and no more.

The Policy Planner sets those rules. It recommends, workflow by workflow, which fields each role sees as tokens, so the control is set per task rather than written once for everyone.

Then AI agents arrived

An AI agent that works in business applications does what the representative does: it opens the account and reads the screen. The difference is that it reads every field, every time, and the text goes into a model's context. OWASP lists the consequence plainly: "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, LLM02, 2025).

Agents can also be steered. In stress tests, Anthropic reported that "In at least some cases, models from all developers resorted to malicious insider behaviors", while noting "We have not seen evidence of agentic misalignment in real deployments" (Anthropic, 2025). The behavior was found in a test, not in the field, but it describes a worker that can be argued into doing something its employer never intended.

Then there is scale. Gartner predicts that "by 2028, an average global Fortune 500 enterprise will have over 150,000 agents in use", up from fewer than 15 in 2025 (Gartner, April 2026). A large outsourcing center staffs hundreds or thousands of seats. An enterprise running agents at that scale may have more agents reading its screens than it has employees, and each one sees whatever the application draws.

That is the moment we realized the problem we designed for was small next to the one coming. The control we built for people sits exactly where an agent reads: the rendered screen. When we reviewed the market, the gap was wide open. Of 15 AI agents and 86 AI security products reviewed, none describes replacing the customer data an agent reads on a screen with tokens it can work with (How Many AI Security Products Control What an AI Agent Sees?).

One control, for agents and the people beside them

So we redoubled our efforts to make our solution even more capable with AI agents. Inside the RedactSure environment, the model receives the screen with tokens already in place, as described in What Is Render-Layer Tokenization?. A real value is released only at an approved destination, at the moment a named person approves the action, under Supervised Delegation. Every screen the agent read, every action it proposed and every approval lands in the AI Control Record.

The same control applies to people: a worker inside the RedactSure environment sees the same tokens an agent does, with the Policy Planner setting what each role may see.

Setting the rules per workflow matters more with agents than it did with people. Gartner warns that "When the same controls are applied indiscriminately, organizations encounter two common failure modes," and predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents (Gartner, May 2026). A claims workflow and a collections workflow need different fields hidden, and the Policy Planner treats them that way.

Why we lead with AI

Outsourcing centers taught us the problem. AI agents are where it is growing fastest, and where the other layers of the security stack finish their work before the screen the model reads is drawn. That is why RedactSure is an AI agent controls, governance and data protection company, and why the work we started for people now protects the agents that are joining them.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

Bring one workflow where people or agents see more than the task needs, and watch it run on tokens with test values. Book a demo

Sources

1. PCI Security Standards Council, "Are audio/voice recordings permitted to contain sensitive authentication data?," PCI SSC FAQ 1210. https://www.pcisecuritystandards.org/faqs/1210/. Collected card security data on a call should not be recorded.
2. Cornell Law School, Legal Information Institute, "45 CFR 164.502, Uses and disclosures of protected health information: General rules." https://www.law.cornell.edu/cfr/text/45/164.502. The HIPAA minimum necessary standard.
3. CISA, FBI and MS-ISAC, "Scattered Spider," Cybersecurity Advisory AA23-320A, updated July 29, 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a. Actors posing as IT or helpdesk staff to obtain employee credentials.
4. Coinbase Global, Inc., Form 8-K, filed May 15, 2025, U.S. Securities and Exchange Commission. https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm. Support staff paid to collect customer information; estimated expenses of approximately $180 million to $400 million.
5. OWASP, "LLM02:2025 Sensitive Information Disclosure," OWASP Top 10 for LLM Applications 2025. https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/
6. Anthropic, "Agentic Misalignment: How LLMs Could Be Insider Threats," June 2025. https://www.anthropic.com/research/agentic-misalignment. Stress tests of 16 models in hypothetical corporate environments.
7. Gartner, "Gartner Identifies Six Steps to Manage AI Agent Sprawl," press release, April 28, 2026. https://www.gartner.com/en/newsroom/press-releases/2026-04-28-gartner-identifies-six-steps-to-manage-artificial-intelligence-agent-sprawl. Over 150,000 agents in an average global Fortune 500 enterprise by 2028, from fewer than 15 in 2025.
8. Gartner, "Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure," press release, May 26, 2026. https://www.gartner.com/en/newsroom/press-releases/2026-05-26-gartner-says-applying-uniform-governance-across-ai-agents-will-lead-to-enterprise-ai-agent-failure
9. RedactSure Research, "How Many AI Security Products Control What an AI Agent Sees?" October 27, 2026. https://redactsure.com/research/how-many-ai-security-products-control-what-an-ai-agent-sees/. Review of 86 AI security products' public documentation.
10. RedactSure Research, "What Is Render-Layer Tokenization?" https://redactsure.com/research/what-is-render-layer-tokenization/