Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Purview Audit Show What a Computer-Use Agent Saw?
No. The audit record Microsoft documents for Copilot and AI applications holds prompts, responses and the resources an agent accessed, not the rendered pages a computer-use agent reads, so the auditor asking for the screens should ask what the model received from each one and who approved the action.
The answer an audit team reaches is usually slower than the answer a vendor page suggests. A computer-use agent drives a browser the way a person does: it opens an invoice, a customer record or a payroll page, the page renders, and the model receives what is drawn there, including the account number in the remittance block and the salary in the row beside it. Purview keeps a record of AI activity, and the pages that describe that record are specific about its contents: the prompt, the response, the material an answer referenced and the files it touched. Nothing in those descriptions is a field that holds the screen.
The person who meets the gap first is the auditor or security lead handed an incident review. An agent approved a payment, or a customer record surfaced where it should not have, and the question is what the model saw before it acted. The export answers a narrower question: what the agent asked, what it was told and which resources it reached.
A conversation record and a screen recording are different artifacts, produced at different layers.
Key findings
- For a Microsoft audit record to show what a computer-use agent saw, the values on each rendered page would have to be replaced with consistent tokens before the model reads it, so the export holds ACCT_001 where the number sat (What Is an AI Control Record?).
- It would also require a named person approving each payment, and a record that joins the screen the model received to the action that person released (What Is Supervised Delegation?).
- None of the Purview pages reviewed describes a field that holds the rendered screen or a screenshot from a computer-use session; the record is the conversation (Microsoft, Audit logs, 2026).
- Microsoft's audit schema records an AccessedResources property, "References to all resources (files, documents, emails, etc.) which Copilot accessed in response to the user's request" (Microsoft, Audit logs, 2026).
- Microsoft's description of Copilot auditing says records capture "Copilot prompts, responses, and referenced content," and its Purview page lists auditing as a supported capability (Microsoft, How data is protected, 2026; Microsoft, Data security, 2026).
- A GUI-agent privacy benchmark found that screenshot-driven agents "may inadvertently expose sensitive information such as identities, accounts, locations, and behavioral traces" (Wang et al., 2026).
What does the Purview audit log record while a computer-use agent works?
Purview's record of AI activity is a record of interactions. Microsoft's audit schema lists an AccessedResources property, the files and emails an answer touched (Microsoft, Audit logs, 2026), and the company's description of Copilot auditing names prompts, responses and referenced content (Microsoft, How data is protected, 2026). For Copilot Studio agents, the Purview capability list includes auditing (Microsoft, Data security, 2026).
Those fields answer what the log was built for. A computer-use session asks something else. The agent opens a page, the page renders, and the model receives every field on it. The audit entry describes the request and the answer, not the page the model was looking at.
The boundary holds across the 86 AI security products reviewed: 36 describe recording what the model was shown, and each of those records prompts, conversations or request payloads at its own gateway or pipeline, while none describes the rendered screen a computer-use agent read (How Many AI Security Products Control What an AI Agent Sees?).
On the computer-use case, the published answer is narrower: a review of the same documentation found that it "do[es] not explicitly describe an enforcement capability that detects/blocks Copilot's 'computer use' automated browser/session actions" (Does Purview DLP Cover Computer-Using AI Agents?). The allowlist is not a reading control either: access control "only prevents the model from taking actions on websites or applications that aren't in the allow list," so it "doesn't stop the model from opening them" (Does Copilot Studio Limit What Its Agent Sees?).
What does the model receive from a screen that the log never holds?
A rendered page is a dense object. An invoice carries the vendor name, the remittance account, the amount and the approver; a payroll page carries salaries and bank details in one table. A computer-use agent perceives a screenshot of the whole page, including sidebars, notifications and open tabs (Does an AI Agent See Everything on Your Screen?).
A record of prompts and responses can quote an agent saying it paid invoice 4471; it cannot show that the remittance block displayed a different account number, because the values were pixels the model read. A screenshot is the model's input, not an audit artifact (What Does Claude Computer Use See in a Screenshot?).
The screen is also where an attacker meets the model. In the visual prompt injection benchmark, computer-use and browser-use agents "can be deceived at rates of up to 51% and 100%, respectively, on certain platforms" (Cao et al., 2026). EchoLeak showed the same channel in a production Copilot deployment, where the client "automatically fetches the external image URL included by the attacker," with an allowed Teams endpoint used to get past the content security policy (Reddy and Gujral, 2025).
What do the vendors themselves say?
The Microsoft pages that describe the record agree on its shape and say nothing about the screen. The Purview page for Copilot Studio lists the capabilities supported for AI interactions, with auditing among them, and states its limit: "Encryption is supported only with sensitivity labels, and only for the SharePoint knowledge source" (Microsoft, Data security, 2026). The Copilot Studio governance page places the audit trail with the maker, where admins have "full visibility into maker audit logs in Purview" (Microsoft, Governance, 2026). The audit schema lists AccessedResources, "References to all resources (files, documents, emails, etc.) which Copilot accessed in response to the user's request" (Microsoft, Audit logs, 2026).
The record is indexed by request, response and resource, so it answers what the agent asked and touched, and leaves what it saw to another control. AWS's guidance for agent permissions states the test an auditor will apply: audit logs that "attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). Attribution can pass while the screen stays unrecorded.
| Dimension | Microsoft, per its Purview pages | What a buyer should verify |
|---|---|---|
| What the record holds | Prompts, responses, referenced content and the resources an agent accessed | Whether the values in the workflow appear anywhere in the export |
| Computer-use sessions | No page reviewed describes a field for the rendered screen or a screenshot | Whether the session's screens are captured at all, and where |
What should an auditor ask for in writing about the screens?
An auditor who asks for the screens is asking for a class of evidence most agent programs do not produce. The request converts into four questions, each answerable in writing and checkable against a run.
First, what does the record hold for one run: the prompt, the response, the resources touched, or the page the model received? Second, who approved the consequential step, by name, and where is that name stored? Third, were the values on the page replaced before the model read them, and with what, so that a token in the record can be tied to a real value at a known destination? Fourth, how does the record leave the vendor's console and reach the organization's own monitoring?
The mechanisms meant to prevent the problem are probabilistic, which is the reason to ask rather than assume. MIT Technology Review's analysis of refusal states that "because the mechanisms of refusal are probabilistic, they're never likely to be all that reliable," and that determined attackers have already broken through (MIT Technology Review, 2026). A control that misses a few percent of the time is not a record. What tells an auditor what a miss exposed is the record of the screen, and a vendor that shows the conversation and not the page has answered the first question, leaving the organization to decide whether a conversation record is enough for the work.
Who approves what the agent did, and what does that record show?
An audit log answers a question about the agent, and an approval answers a question about a person. The systems reviewed here keep the two apart. The log records that an agent ran and what it reached, and the approval lives in the application or the flow where the action happened. That split is why the approving name often misses the export.
The absence has a cost that surfaces after an incident. The definition of Supervised Delegation records that most enterprise agent deployments cannot name the person accountable for a given agent action, and that after any incident the absence becomes the first audit finding (What Is Supervised Delegation?). An organization can test its position: take one agent action from last month and name its approver from the record alone.
A record built for this question has three parts, and a conversation log supplies one. It needs the screen the model received, the action the agent took and the person who approved it, joined so a reader can follow one run from the page to the payment (What Is an AI Control Record?). Where a part is missing, the reviewer fills the gap from memory or email, and the record shows activity rather than accountability.
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on ACCT_001 and INV_004471 rather than the account number and the invoice total. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms what is tokenized and approves each consequential step, and every screen, action and approval is written to a record that exports to the organization's own monitoring.
The log still holds prompts, responses and resources; the values inside them are tokens, and a token is safe to keep, quote and export. An auditor who asks for the screens can be given the record of what the model received, because the page was rendered in a form that carries no customer data.
An audit policy, a data loss prevention rule and a screen-level control each cover a different layer, and where each sits for this vendor is set out in the comparison (RedactSure vs Microsoft Purview: 2026 Comparison & Alternative).
Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP.
What the record shows
What a model reads is set on the screen, and a record built for the conversation cannot recover it afterward. The audit record Microsoft describes holds the prompt, the response, the referenced content and the resources reached; the pages reviewed name no field for the rendered page of a computer-use session, and enforcement against those browser actions is left open. The research record says the screen is worth recording: a capture carries identities, accounts and locations, and an agent can be deceived by what an attacker draws there. An audit team should check this on one workflow: run an agent against a test invoice page, export the audit record, and compare what it holds with what the page displayed.
Methodology and limitations
This page rests on Microsoft's Purview and Copilot documentation, three research papers, AWS guidance for agent permissions and one press analysis. The vendor pages were read in full, which gives a sound view of where each product applies its control, and the audit schema pages describe the record field by field. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page.
No product on this page was tested hands-on. A statement that a page does not describe a control means only that the pages reviewed do not describe it, and vendor features change, so a release after this page's date is unreviewed until the test above is repeated. The products are described from their public documentation, RedactSure is deploying now with enterprise and government customers, and the example is a record type, an audit request for the screens of one agent run, not an organization. Determinations about compliance belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does Purview audit show what a computer-use agent saw?
No. The audit record Microsoft documents for Copilot and AI applications holds prompts, responses, referenced content and the resources an agent accessed. A computer-use agent reads a rendered page, and the pages reviewed describe no field that holds that page or a screenshot of it. A record produced where the screen renders, with the values already replaced, closes it, and that is the difference the auditor is looking for.
Does the Purview audit log include screenshots?
Not from the pages reviewed. The schema lists the resources an answer touched and the prompts and responses it handled, and no page describes a screenshot field for an agent session. A screenshot is the model's input in the products that work that way, not an audit artifact (Does an AI Agent See Everything on Your Screen?). If the screens are what the review needs, ask for a capture made at the render.
What does Purview record for a Copilot Studio agent?
Interaction records. The capabilities page lists auditing among what Purview supports for AI interactions, and the governance page places maker activity in audit logs that administrators can see. That covers who built and changed an agent and what an interaction asked and answered. It does not describe the values on a page a computer-use session opened. Map the workflow's values onto both questions first.
Can an auditor tell which values the model read?
Not from a conversation record, and not reliably from the page as it stands. The model reads the rendered screen, and the record holds text about the request and the answer. Where the page renders tokens instead of values, the record can show what the model read and still be safe to hand to an assessor. That is the difference between a record of activity and evidence of exposure.
Who approves a computer-use agent's payment?
Often nobody named in the record. The audit log shows the action and the agent, and the approval lives in an application or a flow outside the log, so the export omits the person. A named approver for every consequential step, written into the same record as the screen the model read, answers the question. Ask for one run where the name and the screen sit together.
Does Purview DLP block what an agent reads on a screen?
Only where the data crosses a path a policy covers. DLP acts on the flows it is configured for, such as endpoint activity, SharePoint knowledge and Copilot interactions, and the review of the computer-use case found that enforcement against automated browser actions is not explicitly described (Does Purview DLP Cover Computer-Using AI Agents?). Reading is not a flow a policy sees, so treat a blocked upload as evidence about that step.
How RedactSure Keeps a Record of What the Model Read
An auditor who asks for the screens of an agent run receives a conversation log, because the record was built at a layer that never saw the page.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the model reads the remittance account and the amount, and the log holds the request. Inside the governed environment: the page renders ACCT_001 and INV_004471, and the real number resolves only at the payment a named person approved.
RedactSure is deploying now with enterprise and government customers. In one benchmark, computer-use agents were deceived at rates of up to 51%.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An audit request for the screens is easier to answer before the run than after it. Bring one agent task from your own workflow and see, with test values, what the model reads on the page and what the record keeps. Book a demo