Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Can an AI Agent Complete Its Task Without Seeing PII When Prisma AIRS Protects It at Inference?

Not by inference-time inspection alone, because a guardrail that acts on the prompt sees the PII after the page has been read and can only block or redact it, which stops the task or leaves the model holding the value. Check whether values are replaced with working substitutes before the model reads the screen, so the task still completes.

Sensitive document fields pass through a screen boundary before reaching an abstract inference node and a completed record.

Not by inference-time inspection alone, because a guardrail that acts on the prompt sees the PII after the page has been read and can only block or redact it, which stops the task or leaves the model holding the value. Check whether values are replaced with working substitutes before the model reads the screen, so the task still completes. Palo Alto Networks positions Prisma AIRS as runtime security for agents, and its October 2026 announcement describes guardrails applied before model inference for Claude Enterprise. Buyers in financial services are asking a narrower question than whether the product works: whether an agent that must open a customer account screen can finish its task when the identifying values on that screen are kept from the model. This page is not a product comparison; two live comparisons are linked below. It locates where inference-time inspection acts, examines what a guardrail can do to a prompt that holds PII, runs a task-completion test on one account screen, considers what Prisma Browser's page masking changes, reports what the vendor's documentation says, and states what a governed environment changes. It builds on research on whether masking data still lets an AI agent complete its task.

Key findings

  • Palo Alto Networks describes Prisma AIRS connecting to Claude Enterprise through inference hooks to "apply runtime guardrails before model inference and enforce policies on what interactions are allowed," extending existing DLP policies to keep sensitive data out of prompts; nothing on the page claims the model never receives real values (Palo Alto Networks, 2026).
  • Prisma Browser's WebPage Data Masking "allows you to mask textual content within webpages," on tabs whose URL matches configured conditions, fully supported on Prisma Browser Desktop only; the page says nothing about what a model or agent reads (Palo Alto Networks, 2026).
  • Swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques," which is the difference between a substitute the task can use and a redaction it cannot (arXiv, 2025).
  • Once an agent ingests untrusted input, "it must be constrained so that it is impossible for that input to trigger any consequential actions," a constraint that applies to what the model has already read, not to what it reads next (arXiv, 2025).
  • OWASP's sensitive information disclosure entry treats personal data in a model's input as the exposure, whatever is later filtered from its output (OWASP, 2025).
  • The task-completion test on tokenized screens is the method set out in research on render-layer tokenization.

Where in an agent's run does inference-time inspection act?

An agent working a screen runs a loop: it receives the rendered page as text or a screenshot, the page becomes part of the prompt, the model infers the next action, the action executes, and the loop repeats. Inference hooks, as Palo Alto Networks describes them, sit between the second and third steps: the prompt is assembled, then guardrails are applied "before model inference" (Palo Alto Networks, 2026). That places the control after the page has been read into the prompt.

Two consequences follow. First, the PII is already in the agent's context when the guardrail inspects it; the card number and the name are in the prompt because the agent read the screen. Second, the guardrail's choices are those of any prompt filter: pass, block or alter. Palo Alto Networks describes extending existing DLP policies to keep sensitive data out of prompts, which is the alter or block path.

Take a card servicing account screen as the record type. It shows the cardholder's name, the card number, the last four digits of a national identifier, a mailing address, and a list of recent transactions with merchant names and amounts. The agent's task is to file a dispute on one transaction. When the agent opens the screen, every one of those values enters the prompt. The inference hook then sees a prompt containing a card number and a name alongside the instruction to dispute a transaction. Whatever it does next, it does to a prompt that already holds the PII. OWASP's sensitive information disclosure entry describes the exposure as personal data in the model's input (OWASP, 2025), and by this point the input exists.

What can a guardrail do to a prompt that holds PII, and what can the task do afterward?

Three outcomes are available to a control acting on an assembled prompt. It can block: the prompt containing a card number is refused, the turn ends, the dispute is not filed. It can redact: the card number is replaced with a fixed marker such as [REDACTED] and the prompt passes, but if the dispute form asks for the card's last four digits, the agent has nothing to enter. It can pass: the model reads the PII.

The research on pseudonymization explains why redaction and substitution are not the same thing. Serenari and Lee report that swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques" (arXiv, 2025). A consistent substitute preserves the structure the task needs: the same token refers to the same card on every screen, so the model can carry it from the account view to the dispute form. A redaction marker carries nothing. A prompt-side control could in principle substitute rather than redact, but it would do so after the agent had read the real value, and the mapping would have to persist across every turn of the loop.

Zhao's WebPII benchmark bears on the detection step. It reports a visual redaction model "more than doubling text-extraction baseline accuracy (0.753 vs 0.357 mAP@50)" on rendered web pages (arXiv, 2026), which indicates that detecting PII on a rendered page is a distinct problem from detecting it in prompt text. Either way the control is working on what the agent already captured. Research on whether masking data still lets an AI agent complete its task sets out the completion test that follows.

What does the task-completion test look like on one account screen?

The test has three parts: what the model would have read, what it reads instead, and whether the task completed. Run it on the card account screen with the dispute task.

Before. The agent opens the account screen. The prompt holds the cardholder's name, the full card number, the identifier's last four digits, the address, and the transaction list. An inference-time guardrail inspects the prompt. If it blocks, the run ends and the dispute is not filed: task incomplete, PII already in context. If it redacts the card number and name, the prompt passes; the model opens the dispute form, which asks for the card's last four digits, and it has [REDACTED]: task incomplete or incorrect, PII already in context. If the guardrail passes the prompt, the model reads everything, opens the dispute form, enters the last four digits and the transaction, and the dispute is filed: task complete, PII read. No branch yields the outcome the title asks for.

After. The same screen, with values replaced before the model reads it. The name renders as CUST_001, the card number as CARD_001, the identifier as ID_001, the address as ADDR_001. The transaction list renders with merchant names and amounts intact, because the task needs them to identify the disputed charge, and each transaction carries its own token. The model selects the transaction, opens the dispute form, and enters CARD_001 in the card field and TXN_004 in the transaction field. A named person reviews the submission. At that approved destination, the real last four digits and the transaction reference resolve into the form, and the dispute is filed. Task complete, PII not read. The model carried CARD_001 across two screens because the token was consistent, the property Serenari and Lee measure (arXiv, 2025). Score two columns, completion and exposure; the before-run cannot fill both.

What does Prisma Browser's page masking change for the model?

A buyer will ask whether Palo Alto Networks' browser product closes the gap. Prisma Browser's WebPage Data Masking "allows you to mask textual content within webpages," by PII and PCI type or custom regex, on tabs or frames whose URL matches configured conditions, with up to four characters left unmasked; it is fully supported on Prisma Browser Desktop only (Palo Alto Networks, 2026). Webpage Element Removal hides page elements before the page renders, with the stated limit that "target elements must be part of the main Document Object Model (DOM)" and that the selector tool cannot reach iframes or Shadow DOM (Palo Alto Networks, 2026).

Both are display controls for a person at a browser. The masking documentation says nothing about what a model or agent reads, and a masked card number with four characters showing is not a substitute the agent can carry to a dispute form. Element removal hides controls; it does not turn a value into something a task can use.

If an agent ran inside Prisma Browser Desktop on a tab matching a masking rule, the model would read masked text, closer to the screen than the inference hook. Whether a Prisma Browser session can host an agent, and what it would read, is not described in the pages reviewed. Research on the difference between RedactSure and Palo Alto Prisma Browser for AI agent security treats the browser product on its own terms.

What does the vendor's own documentation say?

The October 2026 announcement states that Prisma AIRS connects to Claude Enterprise through inference hooks to secure Claude Code, Claude.ai and Claude Cowork, that it will "apply runtime guardrails before model inference and enforce policies on what interactions are allowed," that it extends existing DLP policies to keep sensitive data out of prompts, and that it scans models and agent skills before deployment (Palo Alto Networks, 2026). The Prisma AIRS overview describes the runtime security product (Palo Alto Networks, 2026).

Dimension Palo Alto Networks, per its documentation What a buyer should verify
Where the control acts Inference hooks, before model inference Whether the page is already in the prompt at that point
Action on PII in a prompt Extends DLP policies to keep sensitive data out of prompts Block, redact or pass, per data type
Substitution with a working value Not described in the pages reviewed Whether the agent can carry a substitute to a destination form
Page-level masking Prisma Browser WebPage Data Masking, Desktop only Whether an agent session is covered and what it reads
Record of what the model received Not described in the pages reviewed What log shows the prompt as passed

Whether Prisma AIRS replaces a detected value with a consistent, task-usable substitute, and whether any record shows what the model received after the guardrail acted, are not described in the pages reviewed; a buyer should put both questions to the vendor and record the dated answers. Research comparing RedactSure and Prisma AIRS for AI agent runtime security covers the comparison this page does not.

What does a governed environment change?

In a governed environment, the identifying values on a customer account screen are replaced with consistent tokens before any model reads the screen, so the agent files the dispute on tokens and the PII never reaches the prompt that an inference-time guardrail would inspect.

The mechanism is a class of control that sits between the rendered page and the model, ahead of the point where inference hooks act. Values the task does not need in the clear, a name, a card number, an identifier, an address, are replaced with consistent tokens before any model reads them. The agent carries CARD_001 from the account view to the dispute form; the real value resolves only at that approved destination at the moment of an approved action. A named person confirms what is tokenized and approves consequential actions, including every submission. Every screen as the model received it, in token form, every action and every approval is recorded and exported to the organization's own logging.

This bears on the title question because it changes which of the three outcomes is available. An inference-time guardrail chooses among block, redact and pass over a prompt that already holds the PII (Palo Alto Networks, 2026). A control at the render offers a fourth outcome: the prompt never holds the PII and the task still completes, because the substitute is consistent and resolvable, the property Serenari and Lee associate with a fivefold reduction in utility errors (arXiv, 2025). The two controls are not exclusive; a guardrail can still inspect a tokenized prompt for injected instructions, the concern Beurer-Kellner and colleagues raise about untrusted input (arXiv, 2025). The record shows the account screen as the model saw it, with the values absent. The control does not alter the servicing application, the guardrail or the model.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. Agents work inside a governed environment in the customer's own cloud. On every rendered page, including a card servicing account screen, substitution happens at the render layer before any model reads the screen, so the cardholder's name, card number and identifier reach the model as consistent tokens such as ACCT_001 or CUST_001 for the whole run, ahead of the point where an inference-time guardrail would inspect the prompt. Real values resolve only at approved destinations at the moment of an approved action, which for the dispute task is the card field on the dispute form. A named person confirms the tokenization policy and approves every payment, submission and record change, the arrangement RedactSure calls Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM. The design is model agnostic, requires no per-application integration, and leaves user permissions unchanged.

Deployments are in pilot. A pilot on the reader's own dispute workflow would show the account screen as the model received it, the dispute filed on tokens, the confirmation, and the exported record. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on Palo Alto Networks' October 2026 blog announcement of Prisma AIRS for Claude Enterprise, the Prisma AIRS overview documentation, Prisma Browser administration documentation on WebPage Data Masking and Webpage Element Removal, the OWASP Top 10 for LLM Applications entry on sensitive information disclosure, preprints by Serenari and Lee on pseudonymization in conversational AI, Zhao on visual PII detection for computer-use agents, and Beurer-Kellner and colleagues on design patterns against prompt injection, and published RedactSure research pages on Prisma AIRS, Prisma Browser, masking and task completion, render-layer tokenization and the AI Control Record. All sources were read as of October 16, 2026.

No hands-on testing of Prisma AIRS or Prisma Browser was performed for this page. Where a capability is described as not described, the statement means not described in the pages reviewed, not that the product lacks it. Palo Alto Networks' products change often, the Claude Enterprise integration was announced the day before this page was written, and the page carries its date. Research figures are quoted as the preprints report them. Statements about RedactSure describe its current design, with deployments in pilot. The card servicing account screen and the dispute task describe a record type, not any organization, and the token names are illustrative.

Whether a given deployment of inference-time guardrails, browser masking or screen-level substitution meets an organization's obligations under PCI DSS, GLBA, the GDPR or its own data protection policies is a determination for its counsel, its assessors and its own security and compliance officers, not for a research page.

What the record shows

An inference-time guardrail acts on a prompt the agent has already assembled from the screen, so the PII is in the agent's context before the control sees it. From that position the control can block, which ends the task; redact, which leaves the model with a marker it cannot carry to a destination field; or pass, which lets the model read the value. Palo Alto Networks' documentation describes guardrails before model inference and DLP extended to prompts, and does not describe a task-usable substitute or a record of what the model received. The outcome the title asks for, task complete and PII not read, requires substitution before the read with a consistent, resolvable token; RedactSure's environment is one implementation of that method. The test is to name one agent and one task, such as filing a dispute from a card account screen, run it under the guardrail, and score completion and exposure side by side.

Frequently asked questions

Does Prisma AIRS stop the model from seeing PII?

Palo Alto Networks describes applying runtime guardrails before model inference and extending DLP policies to keep sensitive data out of prompts. That can prevent a model from inferring on a prompt that contains PII, by blocking or altering it. The prompt is assembled from the screen the agent already read, so the value has entered the agent's context before the guardrail acts. Whether the model receives the value depends on which action the policy takes.

What is the difference between redacting a value and substituting it?

Redaction removes the value or replaces it with a fixed marker, which carries no information the task can use. Substitution replaces it with a consistent token that refers to the same value on every screen and can be resolved at an approved destination. Serenari and Lee report that consistent pseudonyms reduce semantic utility errors by a factor of five compared to baseline techniques. For an agent that must enter a card's digits in a form, that difference decides whether the task completes.

Can a prompt-side control substitute instead of redact?

In principle a prompt filter could replace detected values with tokens and keep a mapping. It would do so after the agent read the real value from the screen, and it would have to maintain the mapping across every turn of the loop and resolve it at the destination. Palo Alto Networks' pages reviewed describe keeping sensitive data out of prompts and do not describe a substitute the agent carries. A buyer should ask the vendor directly.

Does Prisma Browser's masking cover an AI agent reading the page?

The WebPage Data Masking documentation describes masking textual content within webpages for PII and PCI types on URL-matched tabs, fully supported on Prisma Browser Desktop only. It says nothing about what a model or agent reads, and whether an agent session can run inside the browser is not described in the pages reviewed. A masked value with up to four characters visible is also not a substitute the agent can carry to a destination form.

Can the two controls run together?

Yes. A control that replaces values before the model reads the screen governs what enters the prompt; an inference-time guardrail inspects the prompt that results. The guardrail would then see tokens rather than PII and could still look for injected instructions, the concern Beurer-Kellner and colleagues raise for agents that ingest untrusted input. The two act at different points in the loop and address different failures, and a buyer can run both without changing either.

How should a buyer score the test?

Two columns per run: did the task complete correctly, and did any real identifying value appear in the model's input. Run the task on the same screen under each control and read the record of what the model received. A run that completes with PII in the input and a run that protects PII but fails the task both score one of two. The method is set out in the research on whether masking data still lets an agent complete its task.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.