Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Purview Enough to Let an Agent Work Patient Records?
No. Purview labels, blocks and audits agent activity inside Microsoft 365, and its pages do not describe replacing the values on a rendered patient record before the model reads them; a team gets a stopped task or a log, so ask what the model receives and who approves each change.
For a health system, a patient chart holds many values at once: a name, a date of birth, a member identifier, a diagnosis, an appointment and a note, and a record in Dynamics draws all of them on one screen. An agent asked to book a follow-up, check eligibility or draft a visit summary reads that screen, and the fields it draws are what the model holds for the rest of the run. Purview is the control plane many health systems already own, and Microsoft's pages set out label, loss prevention and audit coverage for agent interactions inside Microsoft 365. The open question is whether any of that changes the values on the rendered chart before the model reads them, or whether it stops the task and records that it happened. A rule that blocks a record from leaving an application protects the record and ends the job the agent was hired to do; a rule that lets the work continue while the identifiers stay off the screen protects both. The gap between an agent on trial and an agent in production is where a control has to stand (What Is the PII Wall?).
Key findings
- For Purview to let an agent work the record, the values on the rendered chart would have to be replaced with consistent tokens before the model reads the screen, so the run carries PATIENT_4821 where the name sits (What Is Render-Layer Tokenization?).
- It would also require a named person approving each record change and a record of what the model received, because an audit entry is not a statement of what the model saw (RedactSure vs Microsoft Purview: 2026 Comparison & Alternative).
- Purview's pages put labels, loss prevention and audit around the item and the interaction, and none of them describes a substitution on the chart, so an agent allowed to open the record reads the identifiers (RedactSure vs Microsoft Purview: 2026 Comparison & Alternative).
- The GUIGuard-Bench authors record that screenshot-driven GUI agents "may inadvertently expose sensitive information such as identities, accounts, locations, and behavioral traces" (Wang et al., 2026).
- OWASP records that "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, 2025).
- Agents on non-Microsoft channels need pay-as-you-go billing before Purview's coverage applies (Microsoft Learn, Purview, 2026).
What does Purview cover when an agent opens a patient record?
Microsoft's page for Copilot Studio agents lists the capabilities supported for agent interactions, among them DSPM, auditing, data classification, sensitivity labels, data loss prevention, insider risk, communication compliance, eDiscovery and retention (Microsoft Learn, Purview, 2026). Those are controls on an item, a class of content or a record of activity, the shape a compliance program already has.
The coverage has conditions. Copilot Studio's security page says data policies control agent knowledge sources, actions, connectors and skills, and that admins have full visibility into maker audit logs in Purview (Microsoft, Security, 2026). A data policy decides what an agent may be built with and which actions it may call, and an audit log records that a maker changed a configuration, which answers a question about governance and not about the screen.
Two scope statements matter more than the capability list. The page ties endpoint DLP for agents to Teams, SharePoint and Microsoft 365 Copilot "when the knowledge source is SharePoint," and states that "Encryption is supported only with sensitivity labels, and only for the SharePoint knowledge source" (Microsoft Learn, Purview, 2026). A chart in Dynamics is neither a SharePoint knowledge source nor one of the surfaces named, so whether a policy reaches it belongs in writing.
What does the model receive when an agent opens the chart?
A patient record in Dynamics is a form. The chart renders the patient's name, date of birth, member identifier, visit reason, diagnosis codes and the notes field, and an agent driving a browser or a computer-use tool reads the fields it displays. Microsoft's Copilot Studio documentation describes its allow list as a limit on action rather than on reading: the list "only prevents the model from taking actions on websites or applications that aren't in the allow list," and it "doesn't stop the model from opening them" (Does Copilot Studio Limit What Its Agent Sees?).
A destination list, a label and a policy on a connector each narrow where the agent may go or what it may do; none changes the characters the page draws once the agent is on it. Every layer below the page, the label engine, the loss prevention engine and the audit pipeline, finishes its work before the page renders, and an agent reads the rendered page, which is the one surface none of those layers examines (What Is Render-Layer Tokenization?).
A connector can return a payload the form never shows, so two agents on one patient can hold different context at the same time.
What do the vendors themselves say?
Microsoft's documentation answers where the controls sit, and the table reads its statements against what a buyer needs for a chart in Dynamics.
| Dimension | Microsoft, per its documentation | What a buyer should verify |
|---|---|---|
| Where agent DLP applies | Endpoint DLP for agents when the knowledge source is SharePoint (Microsoft Learn, Purview, 2026) | Whether the Dynamics chart is a surface the policy names |
| What governs the agent's actions | Data policies control knowledge sources, actions, connectors and skills (Microsoft, Security, 2026) | Which connectors and actions the policy allows |
| What the model receives | Not stated on the agent page | A per-screen answer, in writing |
Two vendor statements outside the Purview page sharpen it. AWS's guidance for agent permissions says "audit logs attribute every action unambiguously to either an agent or a human actor," which is the test to apply to a Purview log before treating it as an attribution record (AWS, 2026).
Microsoft's support page for Copilot Vision states that "Copilot can view your screen or mobile camera feed," which describes a consumer session that clears its context when it ends, not a control on what an enterprise agent reads from a chart (Microsoft, Copilot Vision, 2026). The three pages document what an agent may reach, what may be done with a labeled item, and that an interaction can be audited; none states that the values on the rendered chart are replaced before the model reads them.
What should a healthcare security team ask for in writing?
Five questions carry most of the review, and each answer belongs in the review file.
- Which record stores and surfaces does the policy name, and is a chart in Dynamics one of them?
- What does the model receive from a rendered patient screen, field by field, and are the identifiers replaced before it reads them?
- Who approves a change to a patient record, by name and role?
- What does the audit record hold: the fields the model read, or only that an interaction occurred?
- Which of the controls is a stop and which is a substitution?
The paste control is the clearest example of a documented stop. Microsoft documents the paste control as a way to "restrict users from pasting sensitive content into browser-based applications," enforced per destination through sensitive service domain groups, with the restriction set to "Audit, Block with override, or Block" (Why Does Microsoft Purview Block a Paste Into the Browser, and What Keeps the Work Moving?). It governs a transfer a person initiates, not what an agent reads once the page has loaded.
A confirmation prompt asks a person to approve what the model proposes, and it does not change what the model already read, because the agent has seen the identifiers first.
Can an agent work the chart while Purview only stops or watches?
A label restricts an item, a loss prevention rule blocks a transfer, and an audit record describes what happened after it happened; each leaves the same gap for an agent hired to work a chart.
Indirect prompt injection can "enable adversaries to remotely (without a direct interface) exploit LLM-integrated applications" (Greshake et al., 2023). A browsing agent's prompt is built from the page it reads, with findings that "include prompt injection, domain validation bypass, and credential exfiltration" once untrusted content reaches it (Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?). Access to private data, exposure to untrusted content and an outbound channel are the lethal trifecta named in the analysis that identified it (Is It Safe to Let AI Agents Read External Web Pages?).
EchoLeak shows the same path inside a production Copilot tenant: the flaw tracked as CVE-2025-32711 let content reaching the model make the client fetch an image, because it "automatically fetches the external image URL" (Reddy and Gujral, 2025).
Refusal is a weak foundation. Arthur Holland Michel, writing in MIT Technology Review, puts the limit plainly: "the mechanisms of refusal are probabilistic, they're never likely to be all that reliable" (MIT Technology Review, 2026).
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on placeholders such as PATIENT_4821. Real values resolve only at an approved destination, at the moment of an approved action, and a named person approves each payment, submission or record change. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For this page's question, the change is the difference between a stopped task and a worked record. The chart is drawn with tokens, the agent books the follow-up on those tokens, and the identifiers resolve only where the organization approved them, at the record store rather than in the transcript. The legal questions stay with the organization, and the technical question becomes answerable, because the record shows what the model received on each screen and who approved each change on it.
The comparison that sets a data-estate control against this one, for the vendor named in the title, is (RedactSure vs Microsoft Purview: 2026 Comparison & Alternative).
What the record shows
The control that decides whether an agent can work the chart is substitution on the rendered screen, not classification of the item behind it. Purview documents labels, loss prevention, audit and retention for agent interactions, with endpoint DLP tied to SharePoint knowledge sources and encryption to labels, and none of those statements puts a token where a patient identifier sits. The gap is what an agent does after it is allowed to open the chart: it reads the identifiers, and the run carries them. Test it on one record type. Open a test chart in Dynamics with a test agent, ask it to change one appointment, and compare the fields in the model's context with the fields the page drew. If a name, a date of birth or a member number appears in that context, the control governs the transfer and the trail, not what the model saw.
Methodology and limitations
This page rests on Microsoft Learn documentation for Purview and Copilot Studio, a Microsoft support page on Copilot Vision, an OWASP entry on sensitive information disclosure, AWS guidance, three research preprints and one essay in MIT Technology Review. Vendor pages were read between October 20, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
None of the products on this page was tested for this page, and "not described" means the pages reviewed, not a finding about the product. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a patient record in Dynamics, not an organization. Determinations about whether a workflow meets a privacy, security or contractual requirement belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Is Purview enough for an agent that works patient records?
No. Purview documents labels, loss prevention, auditing and retention for agent interactions, with conditions that tie agent DLP to SharePoint knowledge sources, and none of that changes the values a rendered chart draws. The work is either blocked or done with the identifiers in the model's context, which is why the answer turns on what the model reads rather than on how many controls the tenant has. That is enough to stop the task, not enough to let an agent work the record safely.
Does Purview stop an agent from opening a labeled patient record?
Only where the policy covers the record store the agent opens and the label travels with the item. Microsoft's page lists the capabilities and the conditions, including endpoint DLP for agents in Teams, SharePoint and Microsoft 365 Copilot when the knowledge source is SharePoint. A chart in Dynamics is not among the surfaces that sentence names, so the coverage question needs an answer in writing.
What does the model receive when an agent opens a chart in Dynamics?
The fields the page renders: the name, the date of birth, the member identifier, the visit reason, the diagnosis codes and the note. A connector may return a narrower payload, and a browser agent reads what the form draws. It is worth checking for each agent, because the context is built from whichever route the agent uses, and both routes deliver real identifiers.
Does Purview's data loss prevention stop a paste into a browser app?
Yes, for the paste. Microsoft documents the control as a way to "restrict users from pasting sensitive content into browser-based applications," set per destination through sensitive service domain groups, with the restriction set to audit, block with override or block. That governs a transfer a person starts. It does not change what an agent reads from a page it is already allowed to open.
Who approves an agent's change to a patient record?
Not from the pages reviewed. The Purview page lists auditing among the capabilities supported for agent interactions, and Copilot Studio's security page says admins see maker audit logs in Purview, which records activity rather than an approver for a record change. Approval has to be named in the workflow, by a person with a role, or it is not a control a reviewer can test.
What record does Purview keep of what the model read?
An audit record of the interaction, not a copy of the screen. Microsoft lists auditing and eDiscovery among the capabilities for agent interactions, and maker audit logs are visible in Purview, which tells a reviewer that activity happened and who configured the agent. It does not state which field values the model received or which the page drew, and that is the record an assessment of the chart needs.
How RedactSure Keeps Patient Identifiers Off the Agent's Screen
Purview can label a chart, block a paste and audit an interaction, none of which lets an agent work the record with identifiers off the screen. Microsoft's Purview page ties endpoint DLP for agents to SharePoint knowledge sources.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent opens the chart and the model receives the name and member number as the form draws them. Inside the governed environment, the chart draws PATIENT_4821, the agent books the follow-up on that token, and the real values resolve at the record store when a named person approves the change.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A chart that reaches the model once stays in the run's context for the rest of the task. Bring one patient-record task and see, with test values, what the model reads and who approves the change. Book a demo