Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does WitnessAI Resolve Tokens at an Approved Destination?
No, not in the pages reviewed: WitnessAI tokenizes values on the AI traffic it intercepts before a model sees them, and no page describes a step that turns a token into the real value at the destination the agent submits to. Ask where the value is held, which destination is approved, and whose name is on the release.
A procurement team that lets an agent pay supplier invoices answers for the bank account number at both ends. The invoice arrives in a portal with the number in the remittance block, and the agent's job is to read it, fill the submission form and send it for payment. The number is on the rendered page, so the model reads it and holds it for the rest of the run. A control that tokenizes model traffic can keep the number out of the prompt, but it does not settle what the destination receives at the submit.
WitnessAI's pages place their control on the AI traffic their platform intercepts, which leaves a rendered screen outside it. The title asks a narrower question: whether a token is turned back into the real value at a destination the agent submits to, and whether anyone names that destination, approves the release and records it. The answer depends on a step the vendor's pages would have to describe, because a token is useful downstream only if something exchanges it for the value the system validates.
The record type here is a supplier invoice submission in a procurement portal, the kind of form where a bank account number has to be right and the agent fills it. A token can hide the number from the model; only a resolution step can put the number where the payment needs it.
Key findings
- For WitnessAI to resolve a token at an approved destination, its pages would have to name the destination and the step that exchanges the token for the real value, and they describe tokenization on the inspected path instead (WitnessAI, Witness Protect, 2026).
- It would also require a named person approving the release at that destination and a record of what the model saw and what was released (What Is Least Exposure?).
- WitnessAI's pages say that "Data protection tokenizes sensitive information" and do not describe a token format, a resolve step, a rendered screen, or a person approving one action (WitnessAI, Witness Protect, 2026).
- WitnessAI's Agentic Security post says its tokenization "ensures the agent never sees sensitive values, and neither do downstream tools or databases it accesses," leaving open where the real value is restored (WitnessAI, Agentic Security, 2026).
- Agentic Control "governs agents at the tool boundary," and "Every blocked call writes an audit record naming the user, the agent, the tool, and the rule that denied it," a record of a denied call, not a release (WitnessAI, Agentic Control, 2026).
- AWS's token vault is built to "Securely store OAuth 2.0 Access and Refresh tokens, API keys, and OAuth 2.0 client secrets," and the agent retrieves them with its own workload token, a destination-side design the pages reviewed do not describe (Douglas III, 2025).
Where do WitnessAI's tokens go after the model receives them?
WitnessAI's Protect page puts tokenization on the path to the model and stops at the substitution: the platform will "Keep sensitive PII, credentials, and secrets safe by identifying and tokenizing them before they ever reach an AI model or agent" (WitnessAI, Witness Protect, 2026). A value goes in, a token comes out, and the model receives the token. The page stops at the substitution.
WitnessAI is one of 86 AI security and data protection products in a review that found none describing reversible tokenization of what an agent reads on a screen, with the real value resolved only at an approved destination (How Many AI Security Products Control What an AI Agent Sees?).
The Agentic Security post carries the claim to the systems behind the agent, saying tokenization "ensures the agent never sees sensitive values, and neither do downstream tools or databases it accesses," a claim that covers the inspected path and leaves the release of a real value undescribed (WitnessAI, Agentic Security, 2026). Either the downstream system works on a token and never receives the value, or something outside the pages restores it before the write.
A token vault shows the missing step: AWS's AgentCore Identity is built to "Securely store OAuth 2.0 Access and Refresh tokens, API keys, and OAuth 2.0 client secrets," and the agent retrieves them with its own workload token (Douglas III, 2025). RFC 9700 requires refresh tokens for public clients to be "sender-constrained or use refresh token rotation" (IETF, 2025). OWASP's agentic Top 10 lists Identity & Privilege Abuse among its risks and opens with the observation that "Once AI began taking actions, the nature of security changed forever" (OWASP GenAI Security Project, 2025).
For the supplier invoice, the payment system validates a real account number and rejects a placeholder, so some component has to resolve the token before the submit (Can an AI Agent Work With a Placeholder Instead of a Real Credential?).
What would an approved destination for a token require?
An approved destination is a property of a token, not a line on a policy page. It is the exact place a real value may go: a form action, an endpoint, a payment rail, named before the run starts and fixed for its duration.
First, the destination has to be named. RFC 9700 requires refresh tokens for public clients to be "sender-constrained or use refresh token rotation," because a token that can be redeemed anywhere is usable by whoever holds it (IETF, 2025).
Second, the value has to be held where the model cannot read it. A vault or a mapping store is the usual answer: the value sits outside the model's context, the token stands in for it, and the exchange happens at the destination (What Is Render-Layer Tokenization?). Masking often keeps partial visibility instead (Runtime Tokenization vs Data Masking for AI Agents), and a partial value is still a value. MIT Sloan defines agentic AI as systems "capable of pursuing goals autonomously by making decisions, taking actions, and adapting to dynamic environments without constant human oversight," so the destination is fixed before a run (MIT Sloan Management Review, 2025).
Third, a person has to approve the release. OpenAI's governance paper calls human approval "a standard way to limit egregious failures," which names the approval but not the destination (Shavit et al., 2023). The environment has to know the value, the destination and the approver.
What do the vendors themselves say?
WitnessAI's product pages and its two 2026 agent posts describe a control layer on AI traffic, each naming a different point on it.
| Dimension | WitnessAI, per its documentation | What a buyer should verify |
|---|---|---|
| Where the control sits | "identifying and tokenizing them before they ever reach an AI model or agent" (WitnessAI, Witness Protect, 2026) | Which hop the vendor inspects, and whether a rendered page is on it |
| What the model receives | "Data protection tokenizes sensitive information." (WitnessAI, Witness Protect, 2026) | What the model receives from the screen, field by field |
| Where a token resolves | Not described in the four pages reviewed | The destination, the value, and the step that returns it |
| Who approves the release | "WitnessAI has closed that gap with Agentic Control, which governs agents at the tool boundary, the moment an agent acts on a system" (WitnessAI, Agentic Control, 2026) | A named person who approves the release of one value |
The Protect page describes the platform's job as "identifying and tokenizing" values before they reach a model or agent, a substitution on the inspected path rather than a resolve step, and adds that "Data protection tokenizes sensitive information" (WitnessAI, Witness Protect, 2026). Agentic Control moves the control to the tool boundary, where it "governs agents at the tool boundary, the moment an agent acts on a system," a control on a tool call rather than on a screen (WitnessAI, Agentic Control, 2026).
Across the four pages, the token format, the destination a token may be redeemed at, and the person who approves a release are not described in the pages reviewed. The pages describe a substitution on the inspected path.
What does an agent read when it opens a submit form?
The record for this page is a supplier invoice submission in a procurement portal. The agent opens the invoice, and the screen draws the supplier name, the invoice number, the amount due and, in the remittance block, the bank account number the payment will use. The model receives the rendered page, including the account number. The read is not a prompt; it is a screen an application drew.
WitnessAI's control reaches the read only if the values cross a path its platform inspects. The invoice screen is drawn by the portal, so the account number is on the screen before any prompt exists. Agentic Control's "pre-execution scan blocks attacks and tokenizes PII and secrets before the agent acts" (WitnessAI, Agentic Control, 2026), but the number was in the model's context by then. The scan can block the call; it cannot unread the page.
That order matters for the submission. The form needs the real account number in the field, and the model is filling it. A placeholder typed into the field would fail the portal's validation, and a value the model never held would have to be injected at submission (Can a Browser Agent Fill In a Form Without Seeing the Values?). Typing-time substitution covers the fill, not the submit.
The destination check has the same shape: if the agent decides where to submit, a hijacked page can point it somewhere else, and a study of browsing agents reports findings that "include prompt injection, domain validation bypass, and credential exfiltration" (How Do I Control Where a Browser Agent Can Submit Data?). A form that renders a token and submits where the agent chose has moved the exposure.
What record shows a token resolved and who approved it?
Agentic Control writes its audit record for a denial: "Every blocked call writes an audit record naming the user, the agent, the tool, and the rule that denied it" (WitnessAI, Agentic Control, 2026). The record names four things, and a resolved value is not one of them. It shows that a call was stopped, not that a token was exchanged, which value it stood for, or where the value went.
Control generates "granular audit trails" of AI activity, which describe the traffic the platform saw, not the value a destination received (WitnessAI, Witness Control, 2026). That is a record of the inspected path. A buyer asking about resolution needs one row per release, with the token, the destination, the time, the request and the name of the person who approved it.
An audit trail of traffic can show that a prompt was redacted and still leave open whether the account number reached the payment system, because the release happens after the traffic the platform saw. For the supplier invoice, the record has to prove the number went to the portal's payment endpoint and nowhere else.
A reviewer who arrives a week later needs to see what the model held on the screen and which destination received the value What Is Least Exposure?. A record that covers only denied calls leaves the allowed release undocumented, and the allowed release is the one that moves money.
What does a governed environment change?
A governed environment is a control class, not a product feature. The page is rendered, the values chosen by policy are replaced with consistent tokens before any model reads it, and the model works on those tokens for the whole run. The bank account appears as ACCT_001 on the invoice screen and every later page, and the model never holds the digits.
Resolution is the other half. Real values resolve only at approved destinations at the moment of an approved action, and the destination is one the policy named before the run, not one the agent chose. A named person approves each payment, submission or record change, and the approval names the value and the destination. Every screen, action and approval is written to a record that exports to the organization's monitoring.
The distinction is the one the WitnessAI comparison page draws: a control on the traffic is not a control on the screen (RedactSure vs WitnessAI: 2026 Comparison & Alternative). A regulated computer-use deployment follows the same design What Is a Secure Environment for Claude Computer Use in Regulated Work?. Its scope is the rendered page, not the terminal, the IDE, the local filesystem, direct API calls or MCP.
What the record shows
A token that becomes a real value only at an approved destination is a different control from a token that hides a value from a model, and the pages reviewed describe the second and not the first. WitnessAI's substitution happens on the traffic its platform inspects, so the model receives a token there. A rendered portal screen is drawn before that traffic exists, and the submit that follows needs the value the portal validates. For the supplier invoice, the test is to name the submission form and the bank account field, ask the vendor to show the request the payment endpoint received, and compare it with the screen the model read. If the endpoint received the real number, the record should name the release. If it received a token, the submission failed. Either answer is checkable in one run, with test values and a test invoice.
Methodology and limitations
This page rests on WitnessAI's Protect, Control and two 2026 agent posts, AWS's AgentCore Identity post, RFC 9700, OWASP's agentic Top 10, MIT Sloan's definition and OpenAI's governance paper, with existing RedactSure research pages. Public documentation read in full gives a sound view of where each product applies its control; the sources were read between October 22, 2026 and October 23, 2026.
WitnessAI's pages and the other sources were read, not tested; none of the products on this page was tested for this page. Where this page says a step is not described in the pages reviewed, it means the pages listed in the Sources. RedactSure is deploying now with enterprise and government customers. The supplier invoice submission is an illustrative record type, not an organization. Compliance determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow.
Frequently asked questions
Does WitnessAI resolve tokens at an approved destination?
No, not in the pages reviewed. WitnessAI tokenizes PII, credentials and sensitive data on the AI traffic its platform inspects, and its four pages describe that substitution. None names a destination where a token is redeemed for the real value, the step that performs the exchange, or the person who approves it. A buyer should treat resolution as undocumented and ask the vendor to show the request a destination received. The absence is the finding a test can confirm.
What does the model receive when WitnessAI tokenizes a prompt?
The tokenized value, on the path the platform inspects. Protect says values are tokenized "before they ever reach an AI model or agent," and the Agentic Security post says the agent never sees sensitive values. What the model receives from a rendered application screen is a separate question, because the screen is drawn before any prompt the platform can scan, and only the inspected path is covered by the quoted sentence.
Who approves the release of a real value?
No named person, on the pages reviewed. WitnessAI describes policies that allow, block, redact or route traffic, and Agentic Control governs a call at the tool boundary. Those are rules applied to traffic. An approval that names one value and one destination, with a person's name on it, is not among the mechanisms the four pages describe. A rule on traffic is not an approval of one release.
What would make a destination approved?
A fixed destination, a stored value the model cannot read, and a named person's approval at the moment of release. The destination is chosen by policy before the run rather than by the agent during it, and the release is recorded with the token, the value, the destination and the approver. Without the first condition the token is a bearer value; without the third it is only a rule. Without all three, the release is either impossible or unrecorded.
What record does WitnessAI keep of a token becoming a value?
None that shows the exchange. Agentic Control writes an audit record for blocked calls naming the user, the agent, the tool and the rule, and Control generates audit trails of AI activity. Both describe traffic the platform saw. Neither is a release record, which would have to name the value that left, the destination that received it and who approved the release. A release record is a different artifact from a traffic log.
Could an agent submit a form while holding only a token?
Only if the destination accepts the token. A payment form validates a real account number, so the field has to receive the value at submission, not the placeholder the model held. That injection has to come from something that knows both the token and the destination, and the pages reviewed do not describe such a component. Without it, the form waits for a person.
How RedactSure Resolves a Token Only at the Approved Submit
A submission needs the real value at the destination, and the approaches reviewed stop at the token.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent opened the supplier invoice and the model received the bank account number on the rendered form, where it could be repeated in the transcript. Inside the governed environment, the form renders with ACCT_001 and BANK_001 for the whole run. At the submit, the real number resolves to the destination the approver named, and the record shows what was released and who approved it.
RedactSure is deploying now with enterprise and government customers. WitnessAI's own pages say values are tokenized "before they ever reach an AI model or agent" and do not describe the step that gives them back.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A token that resolves at the wrong destination pays the wrong supplier. Bring one submission form from your own workflow and see, with test values, what the model reads, who approves the release, and what the record shows. Book a demo