Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Zscaler Enough to Let AI Agents Work on Customer Records?
No, because its pages govern which AI applications a person can reach, what prompts leave, and what crosses MCP and A2A brokers, and none of them describes replacing the values a CRM account page renders before a model reads them. Ask for that control, and for the name of the person who approves a record change.
No, if the measure is what reaches the model when an agent opens a CRM account. The page is the record: a contact card with a name, an email and a mobile number, a contract panel with the account number and the renewal date, an activity feed, and a notes field where a support agent pasted a call summary last week. An agent sent to move the renewal date reads all of it, because the application draws all of it. The security team that owns the Zscaler deployment is usually the team asked to approve that agent, and the question it gets is narrow: whether the platform governs the page or the path around it. A wrong answer puts the account number in a model's context on every renewal the agent touches. The platform covers much of the path around the agent: which AI applications a person may open, the prompts that leave a browser, the calls an agent makes to a model, and the traffic between agents. What it does not cover is the page the CRM draws, and the record's values sit on that page before any request leaves the browser. The team approving the agent should ask for the page as the model receives it, with tokens where the account number sits.
Key findings
- For an agent to work a customer record without reading the customer, the values the page renders would have to be replaced with consistent tokens before any model reads it, with real values released only at the approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each record change and a record of what the model received and who approved it (What Is Supervised Delegation?).
- Zscaler's pages describe seeing "all input prompts users send to apps," policy by role, DLP and MCP brokers, and none of the three pages reviewed describes a substitution on the page (Zscaler, Generative AI, 2026).
- A measured study of autonomous web agents found that they "are prone to inadvertent use of unnecessary sensitive information," a habit a CRM account rewards because the record holds more than the task needs (Zharmagambetov et al., 2025).
- The failure is documented at production scale: "Cursor's agent deleted PocketOS's production database via a single rogue API call," one of four incidents a Columbia lab lists (Columbia DAPLab, 2026).
- FINRA's 2026 oversight report warns that "Agents may act beyond the user's actual or intended scope and authority" (FINRA, 2025).
What does an agent read when it opens a CRM account?
An agent that opens an account in a CRM is not querying a database. It is reading a page the application drew. A browser agent receives that page as a document: the text of each field, the labels around it, and the values the application put there. A computer-use agent receives a picture of the same page.
The account page holds more than the job. An account might carry a contact card with a name, a work email, a mobile number and a billing address, a contract panel with the account number, the renewal date and the annual value, and a notes field where a support agent pasted a call summary. An agent asked to move the renewal date needs the date and the authority to change it. The mobile number and the account number arrive because the page displayed them.
A page-level control is built for that surplus. What Is the PII Wall? puts the boundary where a value would enter a model's context. How Can AI Agents Work With Customer Records Without Seeing the Actual Data? describes the substitution: a value replaced by a surrogate that means nothing outside the environment that issued it. A page that is complete on screen is complete in the agent's context.
Where does Zscaler's control sit on that path?
The controls sit on the outside of the browser and the runtime, at the call, the prompt and the upload. The AI security page states that the product "sits inline across the full AI workflow" and governs "every model, agent, and API call in real time" (Zscaler, AI Security, 2026).
For agents, the same page adds a broker layer. It routes and governs "every AI transaction from one central control plane" and secures "agentic communications through MCP and A2A brokers" (Zscaler, AI Security, 2026). The company's post on the OpenShell reference architecture states that "Zscaler picks up at the moment the agent reaches beyond the runtime" (Zscaler, OpenShell, 2026).
Each control acts on a path out of the agent. The account page is not one of them. The CRM draws it inside whatever environment the agent runs in, and the model receives it before the agent has anything to send. A filter at the egress can block the request that carries the page, which stops the renewal instead of protecting the value. Substituting a token has to happen before that request exists.
What remains is real coverage of a different surface: which models an agent may reach and what may leave the network (RedactSure vs Netskope: 2026 Comparison & Alternative).
What do the vendors themselves say?
The generative AI page promises to "Create and enforce policies around the generative AI tools your users can access and how they can interact, directly or via browser isolation, to protect your sensitive data," and to enforce "DLP blocking across GenAI interactions" (Zscaler, Generative AI, 2026).
The AI security page describes an estate view: it offers "real-time visibility into how AI agents use data and identities," with policies that "block access by role in real time" (Zscaler, AI Security, 2026).
Google's admin help describes one layer of its Gemini defense as "Identifying and redacting external image URLs and suspicious links," which sanitizes a prompt rather than the fields an application renders (Google Workspace, 2026). SAP's course material states that "A2A is primarily used for outbound agent-to-agent communication" and that inbound requests route through its Agent Hub (SAP Learning, 2026). Coder's best-practices page advises that "LLMs and agents can be dangerous if not run with proper boundaries" and that a team should "use separate identities with limited scope whenever interacting autonomously" (Coder, 2026).
| Dimension | Zscaler, per its documentation | What a buyer should verify |
|---|---|---|
| Where the control sits | Inline across AI traffic, at prompts, model calls and MCP and A2A brokers | Whether the control reaches the page an application renders |
| What it inspects | Input prompts, generative AI interactions, agent traffic, data lineage | Whether a field value is inspected before or after the model reads it |
| What it isolates | AI applications rendered in Browser Isolation, with clipboard use restricted | Whether the isolated page still reaches the agent's model in full |
| Who it admits | Access by role, with policies applied to models and agents | Which named person approves an individual record change |
| What it records | Attempts stopped in transit and visibility into agent data use | Whether the record shows what the model read on the account page |
Does browser isolation change what the model receives?
Isolation changes where the page is drawn, not whether it is drawn. The generative AI page renders "AI and ML applications" in Browser Isolation "to allow user prompts while restricting clipboard use for uploads and downloads" (Zscaler, Generative AI, 2026). It closes a route and leaves the page alone.
An agent working inside an isolated browser still receives the rendered account, and the account number is still the number the CRM holds. Isolation moves the drawing to another machine; the record is what the agent reads. The count of products shows where the work sits: 28 AI security and data protection products reviewed control model input or mask a browsing layer, 27 of them in pipelines and 1 in a browsing layer, and none of the 28 describes giving an agent tokens it can work with on a screen, from vendor documentation rather than tests (How Many AI Security Products Control What an AI Agent Sees?).
The filter on the exchange has the same shape. The AI security page promises to "filter sensitive data from LLMs" with "inline DLP and Zero Trust applied to every model, agent, and API call" (Zscaler, AI Security, 2026). A filter can block a request that carries the account number, and blocking it stops the renewal. It can log the request and let it pass, and then the model has the number. Substitution has to happen where the number is put on the page.
Once the value is in context, the run is exposed to it. Does Prompt Injection Expose Customer Records? records that simple injections asking agents to leak personal data they observed during a task reached average attack success rates around 20 percent in a University of Zurich study.
What does a security team ask for in writing?
The approval memo needs four answers, and the platform's own pages supply two of them. What they do not answer is the screen. Put the questions in writing, then ask for a demonstration on your own account with a test record of one renewal.
| Question to put in writing | What the answer names | Why it decides the approval |
|---|---|---|
| What does the model receive from a rendered screen? | The fields as the model sees them, field by field, on this application | The account page is the record; once the values reach the model, nothing later removes them |
| Where is a value replaced, if at all? | The layer and the moment, with the token format | A replacement after the model reads is not a control on the model |
| Who approves a change to this record? | A named person, outside the agent's run | An agent that can save the change can also save the wrong one |
| What record exists of the run? | Every screen, action and approval, exported to the customer's monitoring | An investigation needs what the model read, not only what it sent |
The platform answers the last two in its own terms: policies applied by role, and a record of attempts stopped in transit. What Is an AI Control Record? sets out what the record should contain when a control does sit at the screen.
What does a governed environment change?
A governed environment is a control class, not a product: it acts where a page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on CUST_004 and ACCT_004 where the record holds a name and an account number. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each record change, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For this page's question, the change is the unit of control. The platform's unit is the request: a prompt, a call, a message between agents. The governed environment's unit is the screen the application draws, which is what makes the CRM account answerable.
Two consequences follow. A block no longer has to choose between stopping the work and letting the value through, since the value was never on the page as a value. And the record answers the question an auditor asks after an incident: what did the model read, and who approved the change?
The two designs are set side by side in (RedactSure vs Zscaler: 2026 Comparison & Alternative).
What the record shows
No, not for the screen an agent works a customer record on: the platform's controls act on the paths that leave the browser or the runtime, and the account page reaches the model as the CRM drew it. A control at the render layer would send that page to the model with consistent tokens where the record holds a name, an email or an account number, a named person would approve the renewal change, and the run would leave a record. Test the difference on one account: attach an agent to one renewal, capture the model's context, and compare it with the fields the CRM displays.
Methodology and limitations
This page rests on the public product pages of Zscaler, Google, SAP and Coder, one peer-reviewed benchmark, FINRA's 2026 annual regulatory oversight report and a lab's incident list. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 23, 2026, and each Sources line carries the date for its page.
None of the products was tested for this page, and "not described" means the pages reviewed. Vendor features change, and the page carries its date. The example describes a record type, a CRM account, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations belong to counsel, assessors and the organization's compliance officers.
Frequently asked questions
Is Zscaler enough to let AI agents work on customer records?
No. Its pages cover which AI applications a person can reach, the prompts that leave a browser, DLP across generative AI traffic and the calls an agent makes through MCP and A2A brokers. A CRM account page is drawn by the CRM, so the account number and the contact details reach the model before any of those controls sees a request. What changes the answer is a control on the rendered page and a named approver for the change.
Does browser isolation keep the values on a CRM page out of the model?
No, because the page is still rendered. Isolation moves the drawing to another machine and restricts clipboard use for uploads and downloads, which limits how a person moves data in and out of the page. An agent working inside the isolated browser still reads the fields the application draws, and the account number arrives in the model's context the same way it does without isolation.
What does the model receive when an agent opens an account?
The page as the application renders it: the contact card, the contract panel with the account number and the renewal date, the activity feed and the notes. A browser agent receives that content as text and images, and a computer-use agent receives it as a screenshot. Research on web agents finds they use sensitive information they did not need for the task, and every field on the account sits in front of the model.
Who approves a record change an agent proposes?
Only the process the organization builds around the agent. The pages reviewed describe policies by role and DLP actions on traffic, and they do not describe a named person approving an individual field change before it is saved. An approval inside the agent's own run depends on the model that proposes the change. One outside the run can be tied to a person's identity and written to a record.
What record shows what the model read on the account?
None of the Zscaler pages describes one. They describe visibility into AI use, prompts sent to applications and attempts stopped in transit. A record that answers the question names the account page, the fields as the model received them, the action taken and the person who approved it, and it exports to the organization's own monitoring rather than living only in the vendor's console.
Does Zscaler's DLP stop a customer's account number from reaching the model?
Only by stopping the request that carries it. Inline DLP acts on the exchange between the agent and a model, so it can block a prompt that contains the account number or log the attempt. For the renewal to finish, the prompt carrying the page has to pass, and by then the model has read the value. A substitution keeps the work moving while the model holds a token, and the renewal still finishes.
How RedactSure Keeps the Account Page Out of the Model's View
An agent that updates a renewal date reads the mobile number and the account number because the CRM puts them on one page. Zscaler's pages describe DLP blocking and clipboard-restricted browser isolation, not a replacement of a rendered field.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the account renders, and the model receives the contact's mobile number and the account number beside the renewal date. Inside the governed environment: the page is drawn with CUST_004 and ACCT_004, the agent works the renewal on those tokens, and the real account number resolves at the billing screen on a named person's approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A renewal change on a CRM account is the case that shows whether the account number reaches the model. Bring one account and see, with test values, the page as the model reads it, the approval and the record. Book a demo