Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Island's MCP Gateway Control What the Agent Sees?
No, not the page a browser agent reads: Island's MCP Gateway governs the tool calls routed through it, and a rendered screen never passes through that path. Ask what the model received from the screen, who approved the action and what record names both.
An accounts payable team lets an agent set up vendors in its finance dashboard. When the agent calls the procurement tool, the request crosses a gateway that can read it, log it and refuse it; when the agent opens the vendor page and types the bank details into the form, nothing crossed but a rendered page, and the gateway never sees it. That difference is the question behind an MCP gateway, a product placed on the path agents use to reach tools.
The values at stake sit on the screen: a vendor record holds an account number and a tax identifier, and a customer record holds an address and a date of birth. An agent that reads one of those pages carries the values into its context, and a gateway that governs tool calls has no view of the page that produced them (What Is the PII Wall?). A buyer comparing controls needs to know which path each one sits on, what it can inspect, who approves an action it cannot see, and what record remains. The example throughout is one vendor record in an accounts payable dashboard, read once through a tool and once through the page. Island's MCP Gateway covers the first path, the call an agent sends to a tool, and the browser pages reviewed here cover the second, the person at the screen; the pages describe neither as governing what a browser agent reads.
Key findings
- For the page an agent reads to be governed, its values would have to be replaced with tokens before any model reads the screen, and the real value released only at the approved destination (What Is Render-Layer Tokenization?).
- That also needs a named person approving each consequential action and a record of what the model received on every screen it read (RedactSure vs Island Enterprise Browser: 2026 Comparison & Alternative).
- The gap is the rendered page: no Island page describes a value on a screen replaced before a browser agent's model reads it, while its browser controls are written for the person at the screen (Island, Enterprise Browser, 2026).
- Nightfall AI describes the tool-call control: "MCP Gateway sits in front of every tool call" and "Sensitive data returned by a tool call is sanitized in-flight, before the agent ever sees it," which governs what a tool returns, not what a page renders (Nightfall AI, AI Security, 2026).
- Island's browser page states that "Last-mile controls govern print, downloads, screenshots, and copy/paste even outside the browser," a control on what a person does with data, not on what a model receives (Island, Enterprise Browser, 2026).
- Aurascape's launch post puts the limit in one sentence: "A standalone MCP gateway can only govern the traffic explicitly routed through it," so a screen the agent reads stays outside the gateway (Aurascape, 2026).
What does an MCP gateway see that a screen read never passes through?
An MCP gateway sits on the tool-call path. Nightfall AI, which sells a gateway, describes the placement in two sentences: "MCP Gateway sits in front of every tool call," and "Sensitive data returned by a tool call is sanitized in-flight, before the agent ever sees it" (Nightfall AI, AI Security, 2026). Both are about a call: the request an agent sends to a tool, and the response it returns.
The vendor record shows the difference. Through a tool, the agent makes a create-vendor call with a name, a tax identifier and a bank account, and the gateway can inspect the arguments and rewrite the account number in the response. Through the page, the agent opens the vendor form, reads the account number the finance system renders and types it into the same field. No call is made, so nothing is routed for inspection, and the value is in the model's context before any tool-path policy applies.
That is a difference in position, not in detection quality. A gateway governs what an agent sends to a tool and receives from it; a page governs what the agent reads before it composes anything. A team that reads only the gateway log sees the actions, not the values the agent read to choose them, a limit that Enterprise Browser or Render-Layer Tokenization? sets out for the browser category and How Do I Control Where a Browser Agent Can Submit Data? takes up for the action that follows.
What do Island's pages cover, and where does the human path end?
Island's enterprise browser page is written for the person at the screen. It states that "Last-mile controls govern print, downloads, screenshots, and copy/paste even outside the browser," controls on what a person does with data rather than on what a model receives (Island, Enterprise Browser, 2026).
The AI browser page adds a filter toward the provider: it will "Redact sensitive data before it reaches any AI provider and intercept AI responses before they render to the user," and "data protection operates at the last mile, inside the browser" (Island, AI Browser, 2026).
Its own blog states where the control applies: "Island applies last-mile controls where data enters the prompt: redaction before information reaches an AI provider, context-aware access policies, and audit logging across sessions" (Island, Threat Surface, 2026). The same post says "browser-only coverage leaves the rest of the chain unwatched" and calls agents "a second workforce" with "no registry, no policy, and no audit trail" (Island, Threat Surface, 2026). Read together, the pages describe the person at the browser and the prompt on its way out, not an agent reading a permitted page before it composes a request. That human path is the scope Is Island Enterprise Browser Enough to Protect Data From AI Agents? examines.
What do the vendors themselves say?
Three vendors document a control near this question, and each stops at a different place. The table reads Island's browser pages on their own terms.
| Dimension | Island, per its documentation | What a buyer should verify |
|---|---|---|
| What it governs | "Last-mile controls govern print, downloads, screenshots, and copy/paste even outside the browser" (Island, Enterprise Browser, 2026) | Which of an agent's reads a browser control is meant to catch |
| What reaches a provider | "Redact sensitive data before it reaches any AI provider" (Island, AI Browser, 2026) | Whether a page the agent read crossed that filter before the value entered its context |
| The record | "Island's data protection engine reads the transcript and classifies what it finds" (Island, Compliance API, 2026) | What record exists of the values an agent read on a page |
| The path outside the browser | "browser-only coverage leaves the rest of the chain unwatched" (Island, Threat Surface, 2026) | Which control covers an agent that reaches tools rather than pages |
Nightfall AI's product page describes the gateway as the place "MCP Gateway sits in front of every tool call," and says that "Sensitive data returned by a tool call is sanitized in-flight, before the agent ever sees it" (Nightfall AI, AI Security, 2026). That is a control on what a tool returns, and the page makes no claim about a rendered screen. Aurascape's launch post states the limit every gateway shares: "A standalone MCP gateway can only govern the traffic explicitly routed through it" (Aurascape, 2026). Neither sentence reaches the page an agent reads.
Most of Island's own writing is about the person rather than the agent. Print, download, screenshot and copy/paste are actions a person takes at a device. The AI browser's redaction is placed where data enters a prompt, after the page has been drawn. The product governs the human path and the prompt path; the middle path, an agent reading a permitted page before it composes a request, is the one a buyer checks.
Who approves an agent's action, and what record does the run leave?
On the action path, the record is thinner than the control. FINRA's 2026 oversight report flags that agents "may act beyond the user's actual or intended scope and authority," and that "complicated, multi-step agent reasoning tasks can make outcomes difficult to trace or explain, complicating auditability" (FINRA, 2025). A research design answers part of that gap: it requires that "each governed action carries a typed Action Certificate that a planner-independent checker must accept before execution" (Kadyrbek et al., 2026). The check sits outside the planner, and the paper bounds the claim to trusted tool contracts, so a certificate covers a call and not the page that prompted it.
Island's record for agent sessions is a transcript: its blog says that "Island's data protection engine reads the transcript and classifies what it finds," and that "the Compliance API supplies the full record, and Inference Hooks supply the inline decision" (Island, Compliance API, 2026). Classification reviews what a session said, and the post does not state that a value was replaced before the agent's own model read a screen. The approver and the record attach to the call; the values read on the page leave no per-screen record. A gateway's own log is an action record, and it answers a different question from the one a buyer asks about a screen. Across 86 AI security and data protection products, 36 describe a record of what the model was shown, 22 describe both a SIEM export of AI activity and such a record, and 50 do not describe the record in public documentation, read from vendor documentation rather than tested behavior (How Many AI Security Products Control What an AI Agent Sees?).
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens such as VENDOR_001 for the whole run, and real values resolve only at an approved destination at the moment of an approved action. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. A named person approves each payment, submission and record change, and every screen as tokens, every action and every approval lands in a record that exports to the organization's own monitoring.
For this page's question it moves the control one layer earlier than a gateway can. A gateway inspects traffic a client routes to it; a render-layer control changes what the page contains before the agent reads it, so the value never enters the request the gateway inspects. Under this class a gateway sees tokens in the tool calls it governs.
Its scope is the rendered page. A terminal, an IDE, a local file and a direct API call are outside it, and so is the MCP traffic a gateway handles. A buyer should read a gateway claim and a render-layer claim as answers to two questions: which calls the agent may make, and which values its model may read. RedactSure vs AI Gateways: 2026 Comparison & Alternative sets the gateway category against this class, and RedactSure vs Island Enterprise Browser: 2026 Comparison & Alternative sets the browser category against it.
What the record shows
The values a model holds are decided where the page is drawn, before a request exists, and no gateway on the tool path changes that. Who approves a consequential action is a separate decision, made by a named person and attached to the action rather than to the page, and the record is what remains after both. The gateway governs the calls routed through it, the browser governs what a person does on a managed device, and the screen an agent reads falls between the two descriptions. A team can run a test on one record: run one task twice, once through a tool and once through the page, and compare what the model held with what the gateway logged.
Methodology and limitations
This page rests on vendor documentation from Island, Nightfall AI and Aurascape, one peer-reviewed paper on proof-carrying tool actions, FINRA's 2026 oversight report, and existing RedactSure research pages. Public documentation read in full gives a sound view of where each product applies its control, and the pages were read between October 22, 2026 and October 23, 2026; each Sources line carries the date for its page.
The products on this page are described from their documentation, and none was tested for this page. "Not described in the pages reviewed" means the recorded facts for that page do not contain it, not that a product cannot do it. The example describes a record type, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does Island's MCP Gateway control what the model reads?
No, not the page a browser agent reads. Island's gateway governs the tool calls routed through it, and Island's browser pages place their controls on what a person does with data and their redaction where data enters a prompt. A page an agent opens is drawn by the application and read before any request leaves the browser, so the gateway has nothing to inspect for it.
Does the gateway see values a tool returns before the model reads them?
Only where those values travel as a tool call. Nightfall AI's page describes a gateway in front of every tool call that sanitizes sensitive data returned by a tool before the agent sees it. An agent that reads the same values off a dashboard receives them from the page, and no tool response exists to inspect. Sanitizing a return value and replacing a page's values are different controls.
Who approves an action the gateway cannot see?
A named person, if the workflow is built that way. The pages reviewed here put approval on one gate: proof-carrying tool actions require a checker to accept a certificate before execution, and that check sits outside the planner. It governs a call, and it does not describe an approval attached to a value on a rendered screen. That decision, whether the model may read the value, is made earlier, at the page.
What record does a screen read leave?
A transcript, in the designs that keep one. Island's Compliance API supplies a session record that its data protection engine reads and classifies, and FINRA's 2026 oversight report warns that multi-step agent reasoning can make outcomes difficult to trace or explain. A record of which values the model read on each screen is a different artifact, and none of the pages reviewed describes producing one. A gateway log shows the calls; it does not show the page.
Do Island's browser controls govern what the model reads on a screen?
Not as the pages describe them. The browser page's controls govern print, downloads, screenshots and copy/paste by a person, and the AI browser page places redaction where data enters a prompt. An agent reading a permitted page sits between those two descriptions, and the page content that the AI browser treats as context is not described as filtered first. Ask what the model received.
What should a security team ask a vendor in writing?
Which path the control sits on, tool calls or the rendered page; whether a value is replaced before the model reads it, and where the real value resolves; who approves a consequential action, by name; what record shows the page as the model saw it; and whether the gateway sees the traffic the agent uses. Ask for the answer per workflow, then test one record before trusting it. A written answer that names a control without naming its path is the one to send back.
How RedactSure Keeps a Vendor Record Out of the Agent's Context
A gateway governs the calls routed through it and leaves the page an agent reads untouched. Aurascape's launch post states that "A standalone MCP gateway can only govern the traffic explicitly routed through it" (Aurascape, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent reads the vendor page, the account number renders in full, and the model composes a payment instruction with it. Inside: the page is drawn with VENDOR_001 in the account field, the model reads the token, the real number reaches the payment file on a named person's approval, and the gateway sees only a token.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A vendor record an agent reads is the value a finance team is asked about after the run. Bring one record from your own dashboard and see, with test values, what the model reads and where the real value lands. Book a demo