Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can an AI Agent Issue a Policy Endorsement Without Reading the Policyholder's Data?
No, not on the endorsement screen as insurers render it: the page draws the named insured, the address and the date of birth beside the term being changed, and the model receives all of it. Ask for the rest of the record to be replaced with stand-ins before the agent reads the page.
An insurer that lets an agent add a vehicle to an auto policy is asking for a small change on a large screen. The change is a year, a make, a model, a vehicle identification number, an effective date and the coverage that follows the car for the rest of the policy term. The screen renders the named insured, the address, the date of birth, the policy number, the premium and the billing method around the panel the endorsement touches, because the person who normally works that screen is checking the whole account at once. An agent that opens the page to find one field receives every field, and once a value is in the model's context the reading has already happened: it can be written into a transcript, repeated in a summary or carried to the next page of the run. Insurers already answer to a written program for the AI systems behind regulated decisions, and the data a task does not need is the data a reviewer asks about first. The question is narrower than whether an agent may work in policy administration. It is whether the term the endorsement changes can be issued against a page where the household is not present.
Key findings
- For an agent to issue an endorsement without the policyholder's data, the values on the endorsement screen would have to be replaced with consistent tokens before the model reads it, so the run works with POL_4417 and VEH_003, never a name and a date of birth (What Is Render-Layer Tokenization?).
- It would also require a named person approving each endorsement and a record of what the model received on the screen, because the change alters a contract and a premium (What Is Supervised Delegation?).
- None of the vendor pages reviewed describes a control that withholds the rest of a policy from the model once the endorsement screen is open; the documented controls govern which pages an agent reaches and which actions it may take (Glean, Access policies, 2026).
- Anthropic's Claude in Chrome page states that "Claude sees what's on the page and can act on it," which is the exposure question in one sentence: a policy screen open to the agent is a screen its model has read (Anthropic, 2026).
- A benchmark for autonomous web agents found that they "are prone to inadvertent use of unnecessary sensitive information," the endorsement problem as a measurement, since the vehicle is necessary to the task and the household is not (Zharmagambetov et al., 2025).
- The NAIC bulletin expects insurers to maintain a written program for AI systems that "make, or support decisions related to regulated insurance practices," which places an endorsement agent inside the insurer's governance whether built in house or bought (NAIC, 2023).
What does an endorsement change, and what does the screen show?
An endorsement changes one term of a policy without replacing it: a vehicle, a limit, a deductible or a mailing address. The record scenario here is a vehicle added to an auto policy, with one effective date and the coverage that follows the car.
The screen that performs the change is a policy summary with an editing panel attached. The summary carries the named insured and any co-insured, the service and mailing addresses, the dates of birth, the policy number and term, the drivers, the coverages, the premium and the billing method. The panel asks for the vehicle identification number, the model year, the make and model, the purchase or lease date, the effective date and the coverage selection. A service representative reads both halves at once, which is why the screen is built that way.
The audit trail records that a user changed the policy, when, and the before and after values. It does not record the screen a model read, because until recently the only reader was a person.
That asymmetry is what the title turns on: the endorsement needs the panel, and the panel arrives attached to the household. McKinsey's State of AI research finds 62% of organizations at least experimenting with AI agents and 23% scaling them anywhere, and the gap is where a record like this one stops a project (What Is the PII Wall?). The filings of the 42 largest US insurers say almost nothing about agents: at least 24 list AI as a risk, and none describes using AI agents (How Many Large Companies Are Warning Their Investors About the Risks of AI?).
What does the agent need to read to issue the endorsement?
The task needs five things: the policy, the vehicle, the effective date, the coverage selection and the premium it produces. Everything else belongs to the person checking the account.
| Field on the endorsement screen | Needed to issue the change | What it puts in the model's context |
|---|---|---|
| Policy number | Yes | The record the change attaches to |
| Vehicle identification number, year, make, model | Yes | The term being added |
| Effective date and coverage selection | Yes | The change itself |
| Named insured, co-insured, date of birth | No | The identity of the household |
| Service and mailing address | No | Where the household lives |
| Premium, billing method, last payment | No | The financial relationship |
Three of the six rows exist because a person checking the account wanted them, and an agent working the same screen receives all six.
The task does need consistency: the same policy must carry the same stand-in on every screen of the run, so the agent can tell the vehicle it added from the confirmation page. Replacing identifiers with consistent pseudonyms and restoring them after the model has done its work reduces semantic utility errors by a factor of five compared with baseline techniques (Does Masking Data Still Let an AI Agent Complete Its Task?).
What do the vendors themselves say?
The pages that bear on this question come from browser agents that read screens and governance products that decide what an agent may reach. The reading happens in the browser and in the model's context, whatever system serves the page.
Microsoft's support page for Copilot Vision states that "Copilot can view your screen or mobile camera feed and use Copilot Voice to answer questions and interact with you," which describes a model reading a rendered screen and leaves open which values on it the model received (Microsoft, 2026). The same page says that "A transcript of your conversation with Vision is stored in your conversation history," so what the model saw outlives the session in a place the user can reopen (Microsoft, 2026).
Anthropic's page says the Claude in Chrome side panel defaults to "Automatically approve" mode, pausing when needed, a setting that governs what the agent may do next rather than which values it has already read (Anthropic, 2026). Glean's documentation for agent access policies says the policies govern "what data agents can read and what actions they can execute at runtime," a rule about reach across data sources rather than a change to what a rendered page displays (Glean, Access policies, 2026).
Each leaves the values on a permitted page to the system that serves it, which for an endorsement is the policy platform.
Who approves an endorsement, and what record does the insurer keep?
An endorsement is approved by a person with authority to change the policy, within limits the insurer sets, and that approval is the moment the insurer answers for the change.
The NAIC model bulletin expects insurers to maintain a written program for "the responsible use of AI Systems that make, or support decisions related to regulated insurance practices," and it covers systems from a third-party vendor as well as the insurer's own (NAIC, 2023). It adds that "The AIS Program should address governance, risk management controls, and internal audit functions," which puts the record in front of an examiner (NAIC, 2023).
The record an insurer usually has is the transaction: the user, the timestamp, the fields changed, the premium before and after. Zendesk's help center grants a role that can "take on the credentials of an end user to view and use Zendesk Support as that end user," with no approval step or audit trail described for the session (Zendesk, 2026). The log answers who changed the policy, not what the model read (What Is an AI Control Record?). The AI Agent Index entry for Glean Agents records user approval requirements as "None found, in the actual agent" (AI Agent Index, 2026).
A change of address is where the missing record costs most. An FBI public service announcement on business email compromise tells businesses to "Use secondary channels and/or two-factor authentication to verify requests for changes in account information," the discipline a changed address needs (IC3, 2024).
What happens to the policyholder's data after the agent reads it?
Reading is the event that matters, and the pages show what happens to it afterward.
GitLab's documentation shows the shape of a mask applied later: "When a job outputs the value of a masked variable, the value is replaced with [MASKED] in the job log" (GitLab, 2026). The value was read, then masked at output, a control downstream of the read.
The numbers make this a risk calculation: a SailPoint survey of 353 IT professionals found that 80% of organizations said agents took unintended actions, about 40% said agents "accessed unintended systems," 31% said agents shared inappropriate data and 23% said agents revealed credentials (How Do You Test Whether an AI Agent Can Reach Data Outside Its Assigned Task?).
For an endorsement, the unintended action is usually small: a second vehicle added to the wrong policy, a coverage selected on the wrong effective date. The transcript of a misdirected endorsement still holds a person, an address, a date of birth and a billing method. An insurance review of one browser agent reaches the same condition: the values on each policy screen would have to be replaced with consistent tokens before the model reads it (Is Grok Bot Safe for Insurance Staff?).
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, and for this question it changes four things.
The first is what the model receives. The page is drawn by the environment, and values chosen by policy are replaced with consistent tokens before any model reads it, so the endorsement screen shows POL_4417, INSURED_002 and VEH_003 where the policy number, the name and the vehicle sit. The second is where the real values go: they resolve only at approved destinations, at the moment of an approved action, which for an endorsement is the policy record and the confirmation. The third is who approves: a named person approves each endorsement with the change and the premium in front of them, and the approval is an event outside the model. The fourth is the record: every screen the model read, every action and every approval goes to a record that exports to the insurer's monitoring.
What the class changes is the middle of the run. The agent still opens the screen, finds the vehicle, submits the change, and needs the same approval. What it no longer receives is the household that the screen carries for a person's benefit. A comparison of the two browser-agent approaches puts it the same way, with the page as the place the control has to sit (RedactSure vs Claude in Chrome: 2026 Comparison & Alternative).
What the record shows
An endorsement issues without the policyholder's data when the page the model reads is drawn with stand-ins for everything except the term, a named person approves the change, and the run leaves a record of what the model received. On the record reviewed here, the last two are closer to what insurers have: transactions carry an approver, and the bulletin expects an audit function. The reading is the part with no home, because transaction logs record changes and nobody recorded a screen before models read them. The check is small. Name one endorsement type, one test policy and one canary value the task does not need, run it once as the agent works today and once against a page where the household is substituted, then compare what the model received with what the screen held.
Methodology and limitations
This page rests on two research entries on web-agent privacy and agent approval defaults, four vendor documentation pages, two regulator documents, and existing RedactSure research pages. Public documentation read in full gives a sound view of where each product applies its control, and vendor pages were read between October 20, 2026 and October 22, 2026.
No product on this page was tested for it, RedactSure included, and "not described in the pages reviewed" means the recorded facts for that page do not cover the point. Vendor features change and the page carries its date. The example describes a record type, an endorsement adding a vehicle to an auto policy, and not an organization. Determinations about a workflow's compliance belong to counsel, assessors and the organization's own compliance officers.
Frequently asked questions
Can an AI agent issue a policy endorsement without reading the policyholder's data?
No, not against the endorsement screen as it is normally built. The panel that adds a vehicle sits beside a policy summary that renders the named insured, the address, the date of birth and the billing method, and a model reading the page receives all of them. The endorsement needs none of them. The answer changes only when the page is drawn with stand-ins for everything except the term being changed, so the model works the vehicle and never the household.
What does the model receive when an agent opens an endorsement?
Everything the screen shows, including the fields the task does not touch: the named insured, any co-insured, the addresses, the dates of birth, the policy number and term, the premium, the billing method and the vehicles already listed. The system's audit trail records the change the agent made, not the screen the model read, so the reading is invisible to the record an insurer keeps.
Does an approval step keep the policyholder's data out of the model?
No. An approver decides whether a change goes through, and the decision comes after the model has read the page. The approval governs the action, not the reading, and an underwriter reviewing a vehicle addition is looking at a transaction a model already saw in full. The two controls are complementary: one limits what the agent may do, the other limits what it receives, and an insurer's program should name both.
What record should an insurer keep of an agent's endorsement?
One that names the person who approved the change, the values the screen held and the values the model received, kept with the transaction, not in a vendor console. The policy transaction covers the first two. The third is new, because a screen was never an event for a person, and it is the evidence an examiner will ask for when a model sits inside a regulated workflow.
Do browser vendors stop an agent from reading sensitive fields on a page?
No, from the pages reviewed. Anthropic says Claude sees what's on the page and can act on it, and Microsoft says Copilot can view your screen or camera feed. What those pages document is where an agent may go, what it may do and how long context is kept. A setting that pauses an action leaves the values on a permitted page to the system that serves it.
What would make the answer to the title question yes?
Three conditions at once: the endorsement page renders stand-ins for the household and the real values resolve only at the destination the insurer approves, a named person approves each change, and the run leaves a record of what the model received. A vendor claim about an approval setting or a site allowlist is not one of the three, because each governs where the agent goes, not what it reads.
How RedactSure Issues an Endorsement From a Tokenized Policy Screen
An endorsement needs one term from a screen that shows the whole household, and the controls reviewed above govern pages rather than values. A benchmark of autonomous web agents found them prone to "inadvertent use of unnecessary sensitive information," the endorsement failure in one line (Zharmagambetov et al., 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent reads the named insured, the address, the date of birth and the billing method on the way to the vehicle panel, and they stay in context. Inside the governed environment: the page draws POL_4417, INSURED_002 and VEH_003, the endorsement issues against those stand-ins, and the real values resolve on the record when a named underwriter approves.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An endorsement that reads the whole policy puts the household in the transcript for as long as the run lasts. Bring one endorsement from your own book and see, with test values, what the model reads and who approves the change. Book a demo