Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can Wiz Tell You What an AI Agent Saw?
No. Wiz's own pages describe an agentless inventory of AI services, models and exposure built from cloud provider APIs, and its AI Inventory page says browser-based tools require separate governance, so ask what a tool records about one session and whether a screen is in that record.
An auditor who asks for the session is asking for a document that shows what the agent read on each screen and who approved what it did. The security team reaches for the platform it already owns. Wiz is a cloud security platform those teams run, and its AI security posture management pages describe an inventory of AI services, models and data exposure built from cloud provider APIs, with no agent on any endpoint (Wiz, AI Security Posture Management, 2026).
An inventory answers a question about the estate: which AI systems exist, what they can reach, where sensitive data sits. An auditor asks a question about one run: which values appeared on the page a model read, and who signed for the action that followed. Answering the second with evidence built for the first hands over a risk score where a session was requested.
What the auditor wants is one agent session inside a bought application, a system the security team does not build and cannot instrument. Wiz's own AI Inventory page draws the boundary: "Shadow AI outside the cloud (such as browser-based tools) requires separate governance." A browser an agent drives is a browser-based tool, and the governance the inventory disclaims is the one the security team has to produce.
Key findings
- For an inventory to answer an auditor's question about one run, the values the model read on the rendered page would have to be written down at the screen, field by field, and a count of discovered assets cannot stand in for that (What Is an AI Control Record?).
- It would also require a named person approving each consequential action and a record that joins the screen to that approval (What Is Supervised Delegation?).
- None of the three Wiz pages reviewed describes a session record, a screen or an approver; the AI-SPM page sets the scope at discovery, exposure findings, posture and runtime detection and stops there (Wiz, AI Security Posture Management, 2026).
- The product page presents Wiz AI-SPM as "Secure AI applications from code to runtime" and offers to "Discover AI services, technologies, and SDKs without any agents with Wiz's AI-BOM," discovery of an estate rather than a record of a run (Wiz, AI Security Posture Management, 2026).
- The blog that introduced the agent work says Wiz "extends Wiz's agentless CNAPP foundation to secure this new layer of automation," and it frames the product as visibility of what exists rather than a record of one run (Wiz, Securing AI Agents, 2025).
- Glean's policies govern "what data agents can read and what actions they can execute at runtime," a rule about reach rather than a record of a page (Glean, 2026).
What does an auditor get when they ask for the session?
The request usually arrives with no specification attached: produce the session where the agent touched the student record. The security team exports what its platform holds, which on the Wiz pages is a list of AI services, models and integrations, the data stores each can reach and the detections raised (Wiz, AI Security Posture Management, 2026). That answers where AI runs, not what one agent read at 10:41 on a Tuesday.
The difference is a definition. Federal guidance defines an education record as information "directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of" it (U.S. Department of Education, 2026). The word that carries the weight is maintained: a record exists because a system keeps it and can produce it on request.
On a student information system screen, the page draws a name, a date of birth, an accommodation flag and the last three contacts. A browser agent's prompt is built from what the page returns (Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?). The session record an auditor wants holds those values, or holds STU_104 where the name sat and says so (How Do You Audit What an AI Agent Saw and Did?).
A review of 86 AI security products found 36 that describe recording what the model was shown, all of them prompts, conversations or request payloads at their own gateway or pipeline. None of the 86 describes recording the rendered screen an agent read when it acted (How Many AI Security Products Control What an AI Agent Sees?).
What does Wiz's inventory cover, and what does it never see?
The AI bill of materials is the core of it. Wiz says the product will "Discover AI services, technologies, and SDKs without any agents with Wiz's AI-BOM," and the Academy page says "every model, endpoint, dataset, and identity is visible in one place" (Wiz, AI Inventory, 2025). Coverage starts from the cloud control plane: the same page says Wiz "connects to AWS, Azure, GCP, and Kubernetes using standard APIs."
The agent blog describes the runtime layer in its own terms: Wiz "detects and prevents inadvertent access to PII or regulated datasets through misconfigured prompts, storage, or APIs" (Wiz, Securing AI Agents, 2025).
What the same pages place outside the inventory is the browser: "Shadow AI outside the cloud (such as browser-based tools) requires separate governance" (Wiz, AI Inventory, 2025). A bought application an agent drives in a browser is that case, and no cloud API in the estate reports what the tab displayed.
| The question | What an inventory answers | What a session record answers |
|---|---|---|
| Which AI systems exist | Services, models, SDKs and integrations found in the estate | Not its subject |
| What happened at 10:41 | A detection, if a rule fired | Every screen the model read, in order |
| Who approved the action | Not recorded | The named person and the time |
An inventory of AI assets and a record of one session are complements, not substitutes (What Tools Discover and Secure Enterprise AI Agents?), and a map of where agents and data sit is not a record of what a screen showed.
What do the vendors themselves say?
Wiz describes scope in consistent terms across the three documents reviewed. The product page sets the promise as "Secure AI applications from code to runtime" and lists what the product does: discover AI services without agents, "Identify and classify the tools agents can access to understand what actions they can perform," and "Detect prompt injection, rogue agents, and malicious behavior targeting AI systems" (Wiz, AI Security Posture Management, 2026). The first is discovery of reach, and the second is detection of behavior, which raises an event.
| Dimension | Wiz, per its documentation | What a buyer should verify |
|---|---|---|
| Where the control sits | On the cloud estate, through provider APIs, "without any agents" | Whether the application an agent drives is in that estate at all |
| How coverage starts | AI-BOM discovery of services, models, SDKs and integrations | Whether a bought browser application appears in the bill of materials |
| What the model receives | Not addressed on the three pages reviewed | The values on the page, field by field, for one run |
| How real values are restored | No token or substitution step described | Whether any value is replaced before the model reads it |
| The record | Asset inventory, findings and detections | Whether the export holds the screen the model read |
Two other vendors document the same division. Glean's policies govern "what data agents can read and what actions they can execute at runtime," a rule about reach and not a record of a page (Glean, 2026). The AI Agent Index entry for IBM's watsonx Orchestrate reports no dedicated user approval settings and no way to stop an agent mid-run, while IBM describes its controls as "predefined guardrails and policies are enforced automatically" (AI Agent Index, 2026).
Who approves an agent's action, and what record does it leave?
Approval is a decision taken outside the model by a person who can see what is being approved. A posture platform can contribute to that decision and cannot make it: the AI-SPM page promises to "Detect prompt injection, rogue agents, and malicious behavior targeting AI systems," and a detection raises an event for a human to read (Wiz, AI Security Posture Management, 2026).
Autonomy is the reason the gap opens. Agentic systems are "capable of pursuing goals autonomously by making decisions, taking actions, and adapting to dynamic environments without constant human oversight" (MIT Sloan, 2025). People also over-trust automation: automation bias is "the tendency to over-rely on automation" (Goddard et al., 2012), and an approver handed a green risk score and no page will approve.
The content an agent processes is not always benign. A registry study that drew on "98,380 skills collected from two major registries" found 157 skills with confirmed malicious behavior, and skills "bundle natural language instructions and helper scripts that execute with full user privileges" (USENIX, 2026). A rule that fires on its own does not put a person's name next to the action.
Whether an organization needs an approval before every submission or only before the consequential ones is a policy question, and it belongs in writing before an agent touches a payment (Does an AI Agent Need Approval Before Submitting a Transaction?).
What does a governed environment change?
A governed environment is a control class that acts at the point a screen is drawn. Values a policy names are replaced with consistent tokens before any model reads the page, so the model works the record as STU_104 and DOB_104 for the whole run. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each consequential action, and every screen the model read is written to a record that exports to the organization's own monitoring.
For the auditor's request, two things change. The session becomes a document: the record holds the screen with the tokens the model saw, in the order the run produced them, beside the approval and the name. And the answer stops depending on the estate: a bought application that never appears in a cloud inventory still produces a record, because the control sits between the application and the model. Its scope is the rendered page, not the terminal, the IDE, the local filesystem, direct API calls or MCP.
The trade is real: tokens have to be resolved somewhere, a destination has to be approved, and an approver has to be reachable when the run reaches the action. A team that wants one view of the estate and the session will run an inventory and a render-layer control together (RedactSure vs Wiz: 2026 Comparison & Alternative).
What the record shows
The record an auditor can use is built at the screen: the page the model read is captured with the values it drew, the action that followed is tied to a named approver, and the run exports to a system the organization already owns. A posture inventory sits upstream of that record and answers a different question, which is which AI systems exist, what they can reach and where sensitive data sits (Wiz, AI Security Posture Management, 2026). Wiz's three pages describe discovery, exposure findings and runtime detection, and none of them commits to a session record or to a page, so the answer for the auditor's request is no, and it stays no as the inventory grows. A security team should test the estate once: pick one agent task that read a customer or student record last week, ask the security platform for the values the model saw on that screen, and compare what comes back with the ticket the work closed. If the reply is a finding list or a risk score, the session sits somewhere else.
Methodology and limitations
This page rests on Wiz's product page, agent blog and Academy inventory page, vendor documentation from Glean, a research dataset entry from the AI Agent Index, a peer-reviewed review of automation bias, a USENIX Security measurement of agent skills, MIT Sloan's analysis, and federal guidance on what counts as an education record. Vendor pages were read between October 22, 2026 and October 23, 2026, and each Sources line carries the date for its page.
No product on this page was tested for it. The three Wiz pages reviewed are documentation and marketing for a platform, so the page states what they describe and treats anything absent as absent: not described in the pages reviewed, a statement about those pages, not about every deployment. Vendor features change and the page carries its date, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a student information system screen read by an agent, and not an organization.
Determinations about whether a session record satisfies a regulator, an assessor or a contractual audit right belong to counsel, assessors and the organization's own security and compliance officers.
Frequently asked questions
Can Wiz tell you what an AI agent saw?
No. The three Wiz pages reviewed describe discovery of AI services, models and integrations, exposure findings and runtime detection, and none of them describes a screen an agent read or a session record. A team that needs the session has to produce it from the environment the agent ran in, with the values the model received and the name of whoever approved the action. An inventory can point to where to look, and it stops short of the answer.
Does an AI bill of materials record what a model read?
No. An AI-BOM is a list of services, SDKs and models found in the estate, built without an agent on the endpoint. It says which systems exist and where they can reach, and it carries no page, no field and no value. A team can use it to find the applications an agent might touch, then needs a separate record of what one run actually read on those screens. The bill of materials is a starting point, not evidence.
What would an auditor accept as evidence of one session?
A record that names the screen, the values the model received on it, the action taken and the person who approved it, kept where the organization can produce it on request. A risk score, a finding list or an asset count answers a different question and will not satisfy the request. Ask the auditor to name the record type in writing before the run, then check the export against that answer and keep it beside the transcript.
Who approves an agent's action in Wiz?
No approver appears in the pages reviewed. The AI-SPM page covers detection of prompt injection, rogue agents and malicious behavior, and detection is not approval: it does not stop a payment, name a person or record a signature. An organization that requires approval before a consequential action has to place it outside the model, in the workflow that runs the agent, with a record of the decision.
Does runtime detection of prompt injection produce a session record?
No. A detection event records that a rule fired, with the telemetry the rule used, and it does not reconstruct the page the model read. The two records answer different questions: one says an attack pattern appeared, the other says which values were on the screen when the model acted. An incident review usually needs both, and both belong in the file the review opens.
What should a security team ask for in writing before an agent touches a student record?
Ask which values the model receives on the rendered screen, whether they are replaced before the model reads them, who approves a submission or a change, and what export shows the screen the model saw. Ask for the answers beside one test run rather than in a questionnaire. None of the three Wiz pages reviewed commits to the first three, so treat them as open until the run produces them.
How RedactSure Keeps the Session an Auditor Asks For
An inventory of AI systems cannot produce the page an agent read or the name of the person who approved its action.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the student record, the browser draws the name, date of birth and accommodation flag into the model's context, and the auditor's request produces an asset list. Inside the governed environment: the page draws STU_104 and DOB_104, the case proceeds in those tokens, the real values resolve only at the destination an advisor approved, and every screen the model read sits in the record beside the approval.
RedactSure is deploying now with enterprise and government customers. Wiz's own AI Inventory page says browser-based tools require separate governance.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An auditor cannot rebuild a session from an asset list. Bring one agent task and see, with test values, the page as the model receives it, the approval and the record. Book a demo