Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can an AI Agent Process Public Records Requests Without Reading Protected Data?
No. A records request can be logged, routed, tracked and answered without the responsive record ever reaching a model, but the redaction step has to run in a trusted room where someone reads the values it removes; ask which room each agent runs in and what the model receives on the screen.
A records office answers on a clock. The acknowledgment goes out, the search runs across program offices, the responsive pages come back, and a reviewer reads them line by line to decide what the agency may withhold: a Social Security number, a home address, a medical note, a name that would identify someone who never asked for anything. That reading is the work, and it is the step an agent cannot take from outside the record, because removing a value means seeing it first.
The rest of the request tolerates separation. Intake, deadline tracking, fee estimates, correspondence, the exemption index, the release package and the appeal file describe the request rather than the people inside the responsive pages. One record type shows the split: a request for case files, with a benefits letter, an incident line and a statement a neighbor gave in the responsive set, redacted in a trusted room before a redacted copy reaches the response desk.
The stakes sit on both sides of that line. The requester's address is in the request file, the third party's name is in the record, and the reviewer's decision is in an exemption log that may be read again on appeal. A model that reads the responsive pages holds all three in a transcript that outlives the request. A model that reads a tokenized response file can draft the letter without learning who is in it.
Key findings
- Redaction is the one step in a records request that has to see the value it removes, so the responsive record stays in a trusted room and the model that drafts the response reads only consistent tokens such as REQ_014 and SSN_003, never the digits behind them (What Is Render-Layer Tokenization?).
- It would also require a named person approving each partial release and a record of the screen the model received, because human approval "is a standard way to limit egregious failures" (Shavit et al., 2023).
- The system HHS describes decides who may open a case by role and by program office, and none of the pages reviewed states that the values on a responsive page are replaced before a model reads them (HHS, 2016).
- HHS's assessment records that requester files hold "names, mailing addresses, email addresses, phone numbers, Social Security Numbers, dates of birth," and that "SSN may be contained in some of the requests" (HHS, 2016).
- The gap spans layers: Columbia's DAPLab argues that "trustworthy agent automation cannot be solved at a single layer of the stack," because agents turn every layer into a semantic quality problem and a redaction is decided at the record layer (DAPLab, 2026).
- The FBI's CJIS policy defines criminal justice information as "all of the FBI CJIS provided data necessary for law enforcement and civil agencies to perform their missions," which reaches any responsive page that carries an incident history, and any vendor that reads it (FBI CJIS, 2023).
What does a redaction step require the agent to read?
One record type carries the question: a request for case files, where the responsive set holds a benefits letter, an incident line and a statement a neighbor gave. The letter carries the requester's Social Security number and home address, the incident line carries a witness name and date of birth, and the statement carries a third party's account of an evening she never reported. The reviewer's task is to decide, line by line, what goes out and what is withheld under an exemption.
That decision cannot be made from a label. To withhold an SSN the reviewer has to recognize the number, to protect a witness the reviewer has to read who the witness is, and to withhold a medical note the reviewer has to read the note. DOJ's overview defines a Privacy Act record as "any item, collection, or grouping of information about an individual that is maintained by an agency," retrieved in a system of records "by the name of the individual" (DOJ, 2020). The value that makes the file a record is the value the redaction removes.
An agent given that page reads the page. A measured study of web agents found they "are prone to inadvertent use of unnecessary sensitive information," which is the risk in a responsive record that holds every field the agency keeps (Zharmagambetov et al., 2025). A request names three documents and the responsive set returns a folder, so the agent's context fills with fields no one asked about.
A records request that reaches a school district adds another condition. FERPA's school-official exception permits disclosure to an outside provider only where the district keeps direct control over the provider's use and maintenance of the records, which puts the redaction vendor inside the condition rather than outside it (How Can Schools Use AI Without Exposing Student Records?).
What can the response room hold without the record?
Two rooms split the workflow by what each one has to see. The redaction room holds the responsive record, the exemption analysis and the redacted copy. The response room holds the request, the correspondence, the fee record, the exemption index and the release package. An agent in the response room can draft the acknowledgment, estimate the fee, track the deadline and assemble the index without the benefits letter.
The request file is not nothing. HHS's assessment records that "Each OS FOIA Coordinator will have access to only his/her program office's communications and records," so the system already scopes access by role and by office (HHS, 2016). The response room needs its own substitution, REQ_014 in place of the requester's name and address, with the real values resolving at the letter that gets mailed. The room boundary and the token boundary are two controls, and a records office needs both.
The system boundary is already commercial. FLRA's notice says its prior system, FOIAOnline, "was recently decommissioned," and that the replacement, "FOIAXPress, a commercial off-the-shelf product," "will shift storage of records to a FedRAMP-certified third-party cloud environment" (Federal Labor Relations Authority, 2023). An authorization of that cloud covers the vendor's controls; it does not say which room the model runs in or what the page shows it. State law has barely reached the agent's status: of the 45 AI laws enacted in California, Colorado, Illinois and New York in 2025 and 2026, one, California's SB 1159, names AI agents, and it excludes autonomous agents from the definition of a person in public records law (How Many AI Laws Require Human Review of AI Decisions?).
The room assignment is a written policy: name the tasks, the data each needs and the room where each runs. An agent that can open both rooms has no boundary, and an agent asked to reach across is the failure a test can find (How Do You Test Whether an AI Agent Can Reach Data Outside Its Assigned Task?).
What do the vendors themselves say?
The two vendor pages reviewed here describe controls that act on the action rather than on the page. Arcade's post on agent authorization frames the question as "Can this agent, acting for this user, perform this action on this resource?", a scope decision about the action that says nothing about which values the model read before it proposed the action (Arcade, 2025). The same post adds that "Even if a user can delete files in Drive, their agent should only get read access unless deletion is explicitly needed," least privilege applied to a capability rather than a rule about what a page draws (Arcade, 2025).
Glean's agent governance page states that "Glean enforces permissions for every action an agent takes," a permission check at the action that does not describe a substitution before the model reads a screen (Glean, 2026).
| Question | Arcade, per its documentation | Glean, per its documentation |
|---|---|---|
| What the control decides | Whether this agent, for this user, may perform this action on this resource | Which actions an agent may take, checked against its permissions |
| What the model receives | Not described; the page concerns authorization | Not described; the page concerns permission enforcement |
| Who approves | The resource policy that grants the access | The permission configuration |
| What a buyer should verify | That the action check also covers the read that precedes it | That the permission reaches the page the agent opens, not only the write |
Neither page describes a step that replaces values on a rendered page before a model reads them, and that is the step a redaction room depends on. A buyer can put the same question to both vendors and get an answer about actions; the answer about the screen is not described in the pages reviewed.
What does a sandbox or a filter change about the record?
A sandbox contains the process, and a filter inspects what the process produces. Neither one removes the read. Vendor engineering on agent sandboxing states that effective sandboxing requires both filesystem and network isolation and reports an 84 percent reduction in permission prompts, containment on the host rather than protection for the data inside the applications the agent browses (Does Sandboxing an Enterprise AI Agent Protect Your Data?). The benefits letter is drawn inside a case management application, and a sandbox around the browser has no view of the fields that application renders.
A filter on the way out arrives after the read. It inspects text the model has already produced, so the value is in the context before the filter sees it, and the transcript and the tool call that carried it are written before the filter acts. A filter also cannot decide an exemption: it can match a number pattern, not a witness whose date of birth must be withheld.
The workflow has layers: the case system, the browser session, the model, the response letter and the release package. The redaction decision sits at the record layer, and a control at another layer leaves it where it was.
CJIS makes that concrete. The policy "applies to every individual" who is a "contractor, private entity, noncriminal justice agency representative" with access to criminal justice information, so a sandbox vendor, a model vendor and an agent platform in the path are covered by it (FBI CJIS, 2023).
A responsive record can carry instructions too: a third party's submission may hold text a person cannot see, and a hidden instruction can hijack the run (Can Hidden Text on a Web Page Hijack a Browser Agent?).
What should a records officer ask for in writing?
The questions go to the vendor and to the office's own system owner. Start with the room: which tasks does the agent perform, and which of them need the responsive record. Then ask what the model receives from a rendered screen when the agent opens a page, and whether the values are replaced before the model reads them or only after the response is produced. A vendor that answers the action question and not the screen question has answered a different question.
The record comes second. HHS's assessment says its auditing features "will record when a user accesses the system and the actions taken," which names the user and the action and not the page the model received (HHS, 2016). A session recording is no better on its own, because it captures whatever the page drew (Does Browser Use Cloud Record Your Sessions?). Ask for the screen as tokens, the action and the name of the person who approved the release, exported to the office's own monitoring.
The approval is the third question. Human approval "is a standard way to limit egregious failures," and the same paper holds that "at least one human entity is accountable for every uncompensated direct harm" (Shavit et al., 2023). A partial release is a decision with a name on it, and the exemption index should carry that name beside the withheld line.
| Ask | What a good answer names | Why it matters |
|---|---|---|
| Which room | The tasks that need the record and the tasks that do not | An agent with both has no boundary |
| What the model receives | The page as rendered, and whether values are replaced before the read | A control after the read leaves the value in the transcript |
| Who approves | A named person for each partial release | The release is the agency's decision, not the model's |
| What record exists | The screen, the action and the approver, exported | An access log does not show what the model read |
| Retention | How long the transcript is kept and who can open it | The request closes; the transcript may not |
The answers that matter are the ones about the screen, because every other answer describes where the agent may go.
What does a governed environment change?
A governed environment is a control class that acts where a page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a response room agent works on REQ_014, CASE_041 and WIT_002. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each partial release, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
The boundary moves. The redaction room is inside it: the record is read there, by a model or by a person, under a policy that names the values to remove. The response room is outside it: the request, the letters, the exemption index and the release package carry tokens, so the agent that drafts the acknowledgment never holds a name it could repeat.
The substitution does not decide the exemption. A token stands in for a value the policy already selected, and the classification is the redaction room's work. It changes the cost of a mistake on the response side: an injection that reaches the response room collects REQ_014, and a leaked transcript carries tokens that resolve nowhere outside the environment (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
A computer-use agent on a case page would need the same substitution, values replaced with consistent tokens before the model reads it (What Is a Secure Environment for Claude Computer Use in Regulated Work?).
The two-room model moves the trust boundary to a room the agency can name, staff and audit; it does not remove the boundary or the read inside it. An office that puts an agent on the redaction is choosing a model inside the room where the protected values are, so the design question is what that model may keep.
What the record shows
A records workflow rests on three facts: what the model received from the page, who approved the release, and what record survives the run. The redaction room is where the record is read, and the response room is where it is not; an office that separates them can answer a requester, counsel and an auditor from the same file. The HHS system records access by role and by program office, which shows who opened a case, not what a model read in it. The CJIS policy reaches any vendor in the path, and the DAPLab argument says no single layer carries the control. A records officer can test one closed request: open the responsive pages the way the agent would, then list every field the screen draws beside every field the response letter contains. A value in the letter that the redaction room removed is a failure; a token in the letter is the boundary holding.
Methodology and limitations
This page rests on official records guidance from HHS, the Federal Labor Relations Authority, DOJ and the FBI, vendor documentation from Arcade and Glean, a web-agent study, an OpenAI whitepaper, a DAPLab page and existing RedactSure research. Public documentation read in full gives a sound view of where each control applies. Vendor pages were read between October 16, 2026 and October 22, 2026, and each Sources line carries the date for its page.
None of the products on this page was tested for it, and "not described" means the pages reviewed. The HHS assessment states 2016 intended controls for a system then marked new, not audited practice; the FLRA notice is a pre-publication document. DOJ's overview is its 2020 analytical edition, not the statute, and the CJIS wording quoted is the Section 4.1 definition rather than the glossary. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers, and the example describes a record type, not an organization. Exemption determinations belong to counsel and the agency's records officer, and nothing here replaces a pilot of one closed request on the office's own screens.
Frequently asked questions
Can an AI agent process a public records request without reading protected data?
No. An agent can log, route, track, draft and index a request without the responsive record, and the redaction step is the exception: to remove an SSN, a witness name or a medical note, the reviewer has to read the value first. The two-room model puts that read in a trusted room and keeps the response room on request-level data. An agent that can open both rooms has no boundary at all.
What does the model receive when it opens a responsive page?
The rendered page, field by field, including the values the reviewer must remove. A case management screen draws the benefits letter, the incident line and the third party's statement together, and a model given that screen receives all three. There is no reading mode that returns only the exempt line. The practical question is whether the page is drawn with tokens before the model sees it, or whether the model reads the record and the redaction happens afterward.
Who approves a partial release?
A named person, if the workflow names one. The HHS assessment describes role-based access and program-office scoping, which decide who may open the system rather than who approved a specific withholding. An exemption decision is the agency's, and the release file should carry the name of the person who made it beside the withheld line and the exemption claimed. A model can propose a redaction; it cannot sign for one.
Does a sandbox keep the record out of the model's context?
No. A sandbox contains the process on the host, and the record is inside the case management application the agent browses. Vendor engineering on sandboxing reports containment and a reduction in permission prompts, which is a measure of what the agent can reach rather than of what it read. The page still renders, and the model still receives the fields. Pair a sandbox with a control at the page, or the record stays in the context.
What record exists of what the agent read?
An access log, at best. The systems described here keep a record that names the user and the action, and that record does not show the page the model received. A screen recording is no better on its own, because it captures whatever the page drew. The record a review needs names the screen as the model saw it, the action and the approver, and it has to leave the vendor's system.
How should an agency test an agent on one records request?
Start with a closed request that already has a redacted release. Run the agent on the responsive pages with test values, then compare three lists: what the screen drew, what the model's transcript holds and what the release contains. A value in the transcript that the release withheld is the finding. Repeat the run in the response room, where the record should be absent, and check that the agent cannot reach it.
How RedactSure Keeps the Record in the Redaction Room
A records office that hands an agent the responsive file has put every value the reviewer must remove into a transcript the request cannot close. The HHS assessment says "SSN may be contained in some of the requests" (HHS, 2016).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent reads the responsive set and drafts the release letter, so the SSN, the witness name and the date of birth sit in its context. Inside: the redaction room reads the record under policy and audit, a named person approves each release, and the response room drafts from REQ_014 and CASE_041.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A records request that leaves the redaction room carries only what the agency chose to release. Bring one request with a redacted release and see, with test values, what the model reads and where the withheld values resolve. Book a demo