Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Island Redact Data Before It Reaches the AI Model?
No, not the data the model receives from the screen: Island redacts where data enters the prompt, after the page was drawn, and the filter runs one way. Ask what the model read on the rendered page, who approved the action it took and what record exists.
A financial aid officer pastes a sentence into a chat tool: the term balance is unpaid and she wants the payment options. The filter between that tool and its provider can mask the amount before the request arrives. The same week, a browser agent opens the same student account page and reads the total owed, the hold and the payment link. No one pastes anything.
Both paths end with a model answering a question about the same student, and the difference is where a control can stand. A pasted value crosses one narrow point. A page crosses none: the application draws it, the agent reads it, and the request that follows describes what was read. Island says its browser will "Redact sensitive data before it reaches any AI provider," a sentence about the prompt and not about the page that produced it (Island, AI Browser, 2026). A buyer who meets that sentence needs to know which case it covers.
The stakes are the record: a balance, a hold, at times a partial Social Security number, and a route into a payment system. Once those values sit in a model's context they travel with the run (What Is the PII Wall?).
Key findings
- For the data on a page to stay out of a model's reach, the value the agent reads would have to be replaced with a consistent token before any model reads the screen, with the real value released only at the approved destination (What Is Render-Layer Tokenization?).
- That arrangement also needs a named person approving each action the agent takes with the value, and a record of what the model received on each screen (How Do I Limit Where an AI Agent Can Send Data?).
- Island's pages place its redaction where data enters the prompt, and do not describe a value on a rendered page replaced with a token the model can work with (Island, Threat surface, 2026).
- The browser will "intercept AI responses before they render to the user," a control on the reply as it reaches the person, not on the page the agent read (Island, AI Browser, 2026).
- Google's Gemini guidance lists one layer as "Identifying and redacting external image URLs and suspicious links," sanitization of what a model is fed rather than of the values a page holds (Google Workspace, 2026).
- A visual redaction model for computer-use agents reports "more than doubling text-extraction baseline accuracy (0.753 vs 0.357 mAP@50)" on rendered web pages, an accuracy figure rather than a guarantee (Zhao, 2026).
What does Island's redaction cover when a person pastes and an agent reads a page?
The two paths look alike and differ in what a filter can see. A pasted line exists in one place before the request leaves: the prompt. The browser sits on that path, and the value is caught in transit while the person who pasted it still has it.
A page an agent reads offers no equivalent single point. The application draws the account summary, the agent reads the fields, and only then does it compose a request. Island's own account of the control puts it "where data enters the prompt," one step after the page has been read (Island, Threat surface, 2026). By the time a mask applies, the agent has read the balance and the hold.
| What the agent does | What the filter sees | What the model holds |
|---|---|---|
| Pastes a line into a chat box | The prompt, before it leaves | The text with masked values |
| Opens the account page and reads it | The request the agent composes | The page as the application drew it |
The distinction is positional rather than a matter of detection quality. One design puts a filter between a request and a provider; the other puts a substitution between a page and a reader. Enterprise Browser or Render-Layer Tokenization? sets the two categories side by side; only the second changes what the model holds.
What does the model receive when the screen is a student account page?
The record is one student account summary of the kind a student services desk works every day. A vendor knowledge base describes it: "The Account Summary page provides a high-level view of your student account," with "The total amount you owe," "Any holds on your account" and a "Payment portal" (North Carolina Central University, 2026). The payment button sends the payer to a separate portal.
An agent asked whether the family has paid reads those fields. The balance, the hold and the payment link are text in the page, and a computer-use agent receives them as the page renders, whether it reads the document, the accessibility tree or a screenshot. Island states that "Enterprise context, such as identity, page content, behavioral patterns, and company knowledge, automatically enriches every AI interaction," which makes the page an input (Island, AI Browser, 2026).
What the page draws is set by the application's permissions before any AI control runs. In a student information system of the same kind, "All SSNs initially display as XXX-XX-XXXX," and seeing the number takes a separate right (Infinite Campus, 2026). A model receives the view the session was granted, so the screen decides first. A settings page shows the same rule with a token (What Can a Browser Agent See in My GitHub Settings?).
What do the vendors themselves say?
Island describes a filter on the AI connection and a policy layer inside the browser.
| Dimension | Island, per its pages | What a buyer should verify |
|---|---|---|
| Where the redaction runs | "where data enters the prompt" (Island, Threat surface, 2026) | Whether the page an agent reads is covered |
| Where the browser sits | "Data protection operates at the last mile, inside the browser" (Island, AI Browser, 2026) | Whether last mile means the page or the AI connection |
| What record it keeps | "audit logging across sessions" (Island, Threat surface, 2026) | What per-screen record of the model's input exists |
Read together, the rows describe a boundary rather than a page: text on the way out, a reply on the way back, and a log of the session after. The AI browser page adds that it can "automatically sanitize prompts by masking PII," which covers personal data in a request and says nothing about a balance that is not personal data (Island, AI Browser, 2026).
Google's Gemini guidance describes one layer as "Identifying and redacting external image URLs and suspicious links," a filter on the content a model is handed (Google Workspace, 2026). Not described in the pages reviewed is a value on a rendered page replaced with a token before a model reads it, and that absence is the claim this page tests.
Who approves an action, and what record does an agent's run leave?
The pages describe policies and a log, and neither is an approval. The company's own summary is a list: "redaction before information reaches an AI provider, context-aware access policies, and audit logging across sessions" (Island, Threat surface, 2026). An approval decides whether one payment should happen, and it carries a name.
The log is a log of sessions. "audit logging across sessions" records what happened in a browser, which is what an assessor asks for after an incident; it does not show what the model received on a screen or which value a person released.
Over-reliance is the risk in the other direction. A console that reports redaction on every AI interaction invites a reader to stop checking, and the research record is old: "Automation bias (AB), the tendency to over-rely on automation, has been studied in various academic fields" (Goddard et al., 2012).
The reason approval belongs outside the model shows in what an agent can do with what it read: "Cursor's agent deleted PocketOS's production database via a single rogue API call" (Columbia DAPLab, 2026). A named approver who sees the amount is the check a session policy cannot provide, and Does an Enterprise Browser Like Island Protect Credentials From AI Agents? takes up the credential half.
Can a filter that removes a value stand in for a token that replaces it?
Removal and substitution answer different problems, and the difference shows at the field the agent has to fill. Removal is the right shape for a value that must not be kept, and the wrong shape for a value the agent still has to enter. Island's public documentation describes a SIEM export for enterprise-wide visibility and a log of the prompts and actions in a browser session, and it does not describe tokens the agent can work with in place of the values a screen shows (How Many AI Security Products Control What an AI Agent Sees?).
A firewall at a boundary is a near relative. The research describes a "simple, modular, and model-agnostic defense operating at the agent-tool interface," and its authors report that it "achieves perfect security with high utility across all four public benchmarks" (Bhagwatkar et al., 2026).
Neither leaves the agent a value it can use: a masked request has nothing in the field. Substitution differs in what it puts in place: a consistent token, ACCT_014 for the account, held across the pages of the run, with the real value resolved only at the approved destination. The same placement appears in the network layer, where a gateway inspects the request and the response without touching the page (RedactSure vs Netskope: 2026 Comparison & Alternative).
Detection quality is the other half. A visual redaction model for computer-use agents reports "more than doubling text-extraction baseline accuracy (0.753 vs 0.357 mAP@50)" on rendered web pages, which measures how often a detector finds a value, not what happens when it misses (Zhao, 2026).
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on ACCT_014. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each payment, submission or record change, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
The lab's argument is that the layers beneath the model do not cover the flow: "access control governs who can touch data, integrity constraints govern what gets stored, but neither governs how data flows and is used during agentic execution" (Columbia DAPLab, 2026). For this page's question, the change is the input: the account page renders ACCT_014 where the account number sat, so the model reads a placeholder where that value was.
A filter decides what to take out of a message after the page has been read; a render-layer control decides what the page shows before the read. The vendor in the title has a comparison worth reading: RedactSure vs Island Enterprise Browser: 2026 Comparison & Alternative sets the two placements side by side.
What the record shows
A model's view of a page is set at the moment the page renders, and the control that changes it has to act there. Island's pages place the redaction on the request an agent sends to a provider, one step after the read, so the paste case is covered and the page case is not. The record for this page shows the gap in one place: the account summary draws a balance and a hold, the agent reads them, and the request that follows carries them. A filter can remove them from that request, and it cannot give the agent a token to work with or show a person what the model saw. The test takes one run: name one agent and one account page, ask it to read the balance, and compare the text the model received with the page as it rendered. Where the two match, the redaction ran after the reading, and the page is the control that matters.
Methodology and limitations
This page rests on vendor documentation from Island and Google, two knowledge bases, one lab position paper and three research papers. Vendor pages were read between October 22, 2026 and October 23, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested for it. "Not described in the pages reviewed" means the pages recorded for that product do not address the point, not that the product cannot do it; vendor features change, and the page carries its date. The products are described from their documentation, and RedactSure is deploying now with enterprise and government customers. The example describes a record type.
Determinations about whether a workflow meets a regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers, and nothing replaces a pilot of one workflow.
Frequently asked questions
Does Island redact data before it reaches the AI model?
No, not the data the model receives from the screen. Island's pages describe redaction where data enters the prompt, before it reaches a provider, together with prompt masking of PII and interception of responses before they render to the user. A page an agent reads is drawn first, and its values are in what the agent read before any mask applies. What changes the answer is a value replaced on the page before the model reads it.
What does the model receive from a page the agent reads?
The page as the application drew it for that session. In a student account summary that means the balance, any hold and the route to the payment portal; in a student system, the account's rights decide whether an SSN shows in full. Island states that page content enriches every AI interaction, so the page is input. Ask for the page as the model read it.
Is masking a prompt the same as replacing a value on a page?
No. Masking removes text from a request on its way to a provider, and the value is gone from the model's view with nothing in its place. Replacing a value puts a consistent token in the page and keeps it there across screens, so the agent can work with it and the real value can resolve at an approved destination. One protects a request, and the other protects a record while leaving the task possible.
Who approves an action the agent takes after reading a page?
No person, from the pages reviewed. Island describes context-aware access policies that decide what a session may do, and a policy is not an approval of a particular payment or submission. An approval carries a name, happens outside the model, and covers one action with its amount and destination visible. The distinction matters most where the agent starts a payment: the session was already allowed, and the question is who saw the amount.
What record does the browser leave of what the model read?
A session log, not a view of the model's input. Island lists audit logging across sessions among its controls, which answers what happened in the browser: a page opened, a button pressed. It does not show the text the model received on that page or the values masked before it arrived. A team that needs the second record should ask for the screen as the model saw it, exported to its own monitoring, with the approval beside it.
What should a security team ask for in writing about the rendered screen?
Four answers. What the model receives from a rendered screen, and whether a value there is replaced before it reads. Whether the replacement is consistent across pages. Who approves an action that uses the value, and what that person sees. What record of the screen as the model read it exports to the buyer's own monitoring. An answer the documentation does not support is unanswered until a run with test values confirms it.
How RedactSure Keeps the Account Page Out of the Model's Hands
An account page that draws a balance and a hold hands both to any model that reads it, and a prompt filter acts later. Island's own words put the redaction where data enters the prompt, after the page was drawn.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent reads the total owed and the hold and starts the payment, so both values are in the model's context. Inside the governed environment the same page renders ACCT_014, a named person approves the submission, and the real values resolve at the payment destination.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A balance read on an account page travels with the run into every later prompt. Bring one student account task and see, with test values, what the model reads and what record the run leaves. Book a demo