Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Netskope Enough to Let AI Agents Work on Customer Records?
No. Netskope inspects the requests an agent sends and the actions it attempts on network traffic, and a customer record on a screen is read before either exists; ask what the model receives on the rendered page, who approves each change, and what record of that read survives.
A support team that hands an agent a CRM account has already accepted that the agent will read the record. The account page draws a name, a work email, a phone number, a contract value, the billing account number and the notes from the last call, and the model receives all of it, field by field. Netskope's own pages place its controls on the traffic an agent produces and the actions it attempts, later in the run than the read. What Is Render-Layer Tokenization? records why the gap is structural: every established layer of the enterprise security stack finishes its work before a page renders, because until recently nothing but a person ever read a rendered page.
That ordering decides the answer. A gateway, a proxy or a data loss prevention engine sees a request once the agent has composed it, and a browser agent composes that request from a screen it has already read. Netskope documents traffic inspection; the answer turns on whether anything replaced the values on the page before the model read them. A support team should settle that question on one CRM account, a record an account manager opens many times a day and an agent now opens.
Key findings
- For Netskope to be enough on a CRM account, the values on the rendered page would have to be replaced with consistent tokens before the model reads it, so the agent works ACCT_014 and the number resolves only at the approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each record change the agent proposes, and a record of what the model received on the page, exported to the organization's monitoring (How Do You Send an AI Agent's Activity Record to Microsoft Sentinel or CrowdStrike Falcon?).
- The Netskope pages reviewed describe inspection of prompt and response text and of agent actions on network traffic, and none of them states that a value on a rendered page is replaced before a model reads it (Netskope, On Demand, 2026).
- Its On Demand service will "scan AI prompts and responses in real time with AI Guardrails detection engines" and "returns a verdict indicating whether any policy is matched", with enforcement left to the customer's own infrastructure (Netskope, On Demand, 2026).
- A measured evaluation of autonomous web agents found they "are prone to inadvertent use of unnecessary sensitive information", so the exposure needs no injected instruction (Zharmagambetov et al., 2025).
What does an agent read on a CRM account before any request exists?
A CRM account is the record an account manager opens before a renewal call. The page draws the account name, the primary contact's name and work email, a direct phone number, the contract value, the billing account number and six months of notes. An agent asked to move the renewal date reads all of it, because a page snapshot carries the screen as rendered and not the two fields the task needs.
A measured evaluation of autonomous web agents treated the behavior as ordinary rather than adversarial: the agents it tested "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025). The agent reads the page it was given, and the page was built to show a person everything at once. The failures in a research group's incident list are "the predictable consequence of deploying agents that can write to systems designed only to be read by careful humans" (Columbia DAPLab, 2026).
Netskope's pages put their control later. The On Demand service inspects text a caller passes to it, and the action control runs on network traffic, so both act on something the agent has already composed or attempted (Netskope, On Demand, 2026; Netskope, Action Control, 2026). Neither sits between the render and the read, so a request log answers what the agent sent, and only a page account answers what it received (how AI agents work with customer records without seeing the actual data).
Where do Netskope's controls sit relative to the screen a model reads?
Netskope states its own placement. The action control "runs on network traffic Netskope already inspects", and its decision is to block, allow or alert before an action executes (Netskope, Action Control, 2026). The On Demand service is an inspection API: a caller sends "The text content you want inspected by AI Guardrails", receives "a verdict indicating whether any policy is matched", and may then "leverage your existing infrastructure to perform the enforcement" (Netskope, On Demand, 2026). The distance between that inspection point and the screen is one agent step: the browser renders the account page, the agent reads it, and the agent writes a request from what it read. Whatever it holds, a summary, a JSON body or a tool argument, is a copy the agent made. A control on the copy cannot report what the original page displayed, and a policy that stops a value in the copy has already let the value into the run's context.
The review of 86 AI security and data protection products found 58 that describe control over where data can go and 27 that describe control of what a model receives in the pipelines or traffic they handle (How Many AI Security Products Control What an AI Agent Sees?); the rendered page an agent reads is not the object of either count.
Bhagwatkar and colleagues describe a "simple, modular, and model-agnostic defense operating at the agent-tool interface" that "achieves perfect security with high utility across all four public benchmarks: AgentDojo, Agent Security Bench, InjecAgent and tau-Bench" (Bhagwatkar et al., 2026). The same paper records the cost of that placement: the minimizer "aggressively redacts input arguments". The enterprise browser comparison puts that split in front of a category that governs a person's data movement.
What do the vendors themselves say?
The Netskope pages reviewed describe an inspection service and an action gate, not a control on a rendered page. The On Demand documentation states that the service will "scan AI prompts and responses in real time with AI Guardrails detection engines using an API from existing/pre-deployed third-party AI Gateways or AI Agents directly", which inspects text a caller hands over and leaves the read that produced it outside its scope (Netskope, On Demand, 2026). The action control "classifies each agent action by risk, from data destruction to credential misuse, and blocks, allows, or alerts on it before it executes", a decision on an attempted action that does not report which fields a page displayed before the attempt (Netskope, Action Control, 2026). The March 2026 post states that "Netskope One Data Loss Prevention (DLP) inspects data-in-motion to prevent sensitive information (including PII or source code) from being pasted into a prompt or leaked in a response", which governs the paste and the response and not the page a value was read from (Netskope, Blog, 2026).
One other vendor describes an adjacent control. Coder's guidance says not "to give agents full permissions on behalf of a user" and recommends "separate identities with limited scope", a boundary on what an agent may do that leaves open what a page shows it (Coder, 2026).
| Dimension | Netskope, per its documentation | What a buyer should verify |
|---|---|---|
| Where the control sits | "It runs on network traffic Netskope already inspects" (Netskope, Action Control, 2026) | Whether the agent's screen content crosses it |
| What it inspects | "scan AI prompts and responses in real time with AI Guardrails detection engines" (Netskope, On Demand, 2026) | Whether the text is the page as rendered, or a summary |
| What it returns | "returns a verdict indicating whether any policy is matched" (Netskope, On Demand, 2026) | Which component enforces it, and whether it is in this path |
| Data protection | "inspects data-in-motion to prevent sensitive information (including PII or source code) from being pasted into a prompt" (Netskope, Blog, 2026) | Whether a value on the page is replaced before the read |
| Agent actions | "classifies each agent action by risk, from data destruction to credential misuse" (Netskope, Action Control, 2026) | Who approves one action on one record, and where |
Read down the two middle columns: every entry names text or traffic, and the buyer's column asks for a step on the page.
What should a security team ask a vendor in writing?
A team moving an agent from a pilot to a live queue crosses the gap the PII wall describes, where the question stops being whether the agent can do the task and becomes what it is shown while doing it. Three questions cover the ground a public page rarely addresses.
First, what does the model receive from a rendered screen, field by field, and is any value replaced before the read? A vendor that answers with a list of inspected channels has answered a different question.
Second, where does the replacement happen, and is the token consistent across the pages of one run? A placeholder that changes between the account page and the renewal form is one the model cannot work with.
Third, who approves each record change, by name, in the customer's own system? Coder's advice to give agents "separate identities with limited scope" narrows what an agent may do and does not put a person on the change (Coder, 2026). FINRA's 2026 oversight report names the gap: "AI agents acting autonomously without human validation and approval," and adds that "Agents may act beyond the user's actual or intended scope and authority" (FINRA, 2025).
Ask for the sentence in the vendor's documentation, its version and date, and a test on the buyer's own record. The internal page on protecting customer data when Dynamics 365 Copilot agents work CRM records shows that test for one platform.
What does a governed environment change?
A governed environment moves the control to the render. The page is drawn with the values a policy names replaced by consistent tokens, so the account is ACCT_014 and the contact is CONTACT_014 on the account page and on the renewal form. The model reads the tokens. Real values resolve only at the approved destination, at the moment of an approved action, so the billing account number reaches the CRM when a named person approves the change, not the transcript or the next page. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
Three properties separate it from a control on traffic. The first is where it acts: on the values before the model reads them, not on the request the reading produced. The second is consistency: the same account keeps the same token for the whole run. The third is the record, an account of what the model received, which a request log cannot supply.
A team can hold both. A traffic layer covers what an agent sends and does, and a render-layer control covers what the agent reads before either. The comparison for this vendor sets the two side by side (RedactSure vs Netskope: 2026 Comparison & Alternative).
What the record shows
The control that answers the question sits where the page is drawn: the values a policy names are replaced with consistent tokens before any model reads the screen, real values resolve only at the approved destination, a named person approves each record change, and the screens the agent read are exported as a record. Netskope documents inspection of requests and gating of actions, which leaves the read inside the agent's own browser, so a request log shows what the agent sent and cannot show the fields the account page displayed before it sent anything. A security team should test one account: run the agent with the model's input captured, then compare those fields with the fields the page draws. A capture that carries the email, phone and account number is the answer.
Methodology and limitations
This page rests on vendor documentation from Netskope and Coder, on two research papers about web-agent privacy and injection firewalls, on FINRA's 2026 oversight report, on a research group's incident write-up, and on existing RedactSure research pages. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 23, 2026, and each Sources line carries the date for its page.
None of the products on this page was tested for this page, so "not described in the pages reviewed" means only that the recorded pages do not state the point. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a CRM account, and not an organization. Determinations about whether a workflow meets a contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers.
Frequently asked questions
Is Netskope enough to let AI agents work on customer records?
No, not for an agent that reads the record in a browser. The pages reviewed describe inspection of prompt and response text and a risk decision on agent actions taken on network traffic, and none of them states that a value on the rendered page is replaced before the model reads it. That leaves the read itself unaddressed: the account page is drawn for a person, and the model receives it as drawn.
Does Netskope see the customer record before the model does?
No. Its documentation places inspection on the text an agent sends and on the actions it attempts, both of which exist after the page has been read. The record reaches the model when the page renders, inside the agent's browser, and no step in the reviewed pages sits at that point. Ask a vendor to show the capture of the page itself.
Would a data loss prevention policy keep a customer record out of the model?
Not from what the pages reviewed describe. The DLP engine inspects data in motion, to stop sensitive information being pasted into a prompt or leaked in a response, which is a decision about a transfer the agent has already made. A block at that point stops an outbound copy and does not remove the value from the context the agent built while reading the page.
Who should approve an agent's change to a customer record?
A named person, in the customer's own system, for each consequential change. The alternatives on the market are an identity with limited scope, which narrows what the agent may do, and a risk decision on network traffic, which decides whether an attempted action proceeds. Neither puts a person's name on one record change. A regulator's summary of agent risk notes that agents may act without human validation, which is the exposure an approval step closes.
What record should a team keep of an agent's work on a record?
A record of what the model received, not only what the agent sent. A request log, a conversation log and a screen-by-screen account answer different questions, and a customer's auditor will ask the third: which fields the agent saw, which action it took and who approved it. The export matters as much as the retention, because a record that stays with the vendor is one the customer cannot join to its own monitoring.
What would have to change before the answer is yes?
Values replaced with consistent tokens on the rendered page before the model reads it, a named person approving each record change, and a record of what the model received that exports to the customer's monitoring. Those are the three conditions this page tests against every product it reviews. A vendor that documents all three has answered the question, and a vendor that documents traffic inspection has answered a narrower one.
How RedactSure Keeps Customer Records Out of the Model's View
An agent that opens a CRM account reads every field the page draws, and the controls reviewed above act on the request it writes afterward. Netskope documents a service that "returns a verdict indicating whether any policy is matched".
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the account page and the model receives the contact's email, the phone number and the account number as drawn, and they stay in its context. Inside, the page draws CONTACT_014 and ACCT_014, the agent moves the renewal date, and the real values resolve at the CRM destination when a named person approves the update.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A CRM account is the record a support or finance team will ask about first. Bring one task from your own workflow and see, with test values, the fields the model reads on the page, the approval and the record it leaves. Book a demo