Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Can an AI Agent See in a Case Management System?
Everything the case screen draws: identity, address, case number, benefit amount, court and medical records, contact history and the worker's narrative notes, a dossier on one person. Ask which values become a consistent token before the model reads the screen, and who approves the note it writes, because free text is where names arrive unlabeled.
A case file is the fullest record a public agency keeps about one person, and the office that holds it is being asked to let an agent work it. The file opens at intake, where a screener writes down what a caller says, and it accumulates eligibility findings, benefit amounts, court orders, medical evaluations, service contacts, scanned letters and the running notes a caseworker adds after every call. A browser agent asked to summarize the case or draft a letter opens the page the caseworker opens, inside the caseworker's session, and the page draws every field the role permits. The task needs a name and a date, and the page supplies the rest.
The controls an agency already owns look like they answer the question. Role permissions decide which cases a worker may open, and an audit trail records who opened what. Those controls answer who may look. They do not answer what the model receives when the page renders, and the part of the file that carries the most is the part no column can label: the narrative, where a worker writes the mother's name, the stepfather's name and the school the child moved to.
A case file with free-text notes is the record this page follows, because it is the page an agent opens first and the one where a placeholder runs out.
Key findings
- For an agent to work a case file without carrying the family's identifiers, the values on the rendered screen would have to be replaced with consistent tokens before the model reads it, so the client arrives as CLIENT_014 and the case as CASE_002 while the real names resolve only at an approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each note, status change and letter the agent submits, and a record of what the model received on every screen, exported to the agency's own monitoring (What Is an AI Control Record?).
- None of the pages reviewed describes a control over the narrative: the new case system makes the screener narrative available throughout intake, and no page states that a name written into it is replaced before a model reads the screen (Sacramento County DCFAS, 2026).
- A county child welfare system now going live is "a Comprehensive Child Welfare Information System (CCWIS) compliant system" built as "Salesforce with Cloud Based Platform as a Service (PaaS) solution", and its flyer sets "Version 1 Go-Live: Oct. 2026" (Sacramento County DCFAS, 2026).
- A benchmark of autonomous web agents found that they "are prone to inadvertent use of unnecessary sensitive information", the failure a case page invites when the task needs two fields and the page draws thirty (Zharmagambetov et al., 2025).
- The AI Agent Index records approval requirements for decision types on Gemini Enterprise as "None" found and notes that users can pause or stop an agent, a stop control rather than an approval of the note that enters the file (AI Agent Index, 2026).
What does an agent read when it opens a case file?
The record is a case file: the page a caseworker opens for one household and works from all day. It carries the client's legal name, date of birth, address, case number, household composition, eligibility findings, benefit amount, court orders, medical and behavioral evaluations, service authorizations, contact history and the notes a worker writes after each call. What reaches a browser agent is the rendered page: its labels, values and order as text, and the same screen as an image when the agent works from a capture (What Does an AI Agent See in a Screenshot?).
| What the case screen draws | What the model receives without a control |
|---|---|
| Client identity | Name, date of birth, address, case number |
| Narrative note | The note as the worker wrote it, names included |
| Court and medical records | Orders, diagnoses and evaluation text |
| Benefit and payment detail | Amount, payee and bank details where the file holds them |
| Contact history | Calls, visits and letters, with names and dates |
The screener narrative is the field that makes a case file a story rather than a set of columns. The CWS-CARES flyer for a county replacing its case management system says that "The screener narrative will be available for easy access throughout Intake" (Sacramento County DCFAS, 2026). Easy access for the worker is the point of the field, and the same page is what a model reads when the agent opens the case.
An agency usually points to role permissions at this stage, and they are real controls. They decide which cases a worker may open and which fields a role may view. They do not decide what leaves the page once a model reads it. A case file is also the workflow the PII wall describes: valuable to the agency, and built on data a security team would rather a model never held (What Is the PII Wall?).
Why is the narrative the limit of a placeholder?
A placeholder works when a value has a shape and a place. A Social Security number sits in a field labeled for it, an account number sits in a payment record, and a policy that names both can replace them wherever those fields render. A narrative has no such shape. A worker writes that the stepfather moved out on 12 March and the child is staying with a neighbor, and the sentence carries three identities, a date and a living arrangement that no column rule recognizes.
Consistent tokens can cover a name the case record already holds, because the policy knows the client and the household. They cannot cover a name the note introduces: the neighbor, the teacher, the person who answered the phone. That is the honest limit of a render-layer control on a case file, and it is why the note needs a person at the end of it. A token can make the client CLIENT_014 everywhere; it cannot make a stranger a token.
The failure is measured rather than hypothetical. A benchmark of autonomous web agents found that they "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025). An agent asked for a summary does not stop at the two fields the task names, and a case page gives it thirty. What limits the damage is what the model was shown before it began, which is the argument for tokens, and where the narrative is concerned, the argument for an approver (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
Whether the browser is a consumer assistant or an enterprise agent, the page is what the model receives, so the same question decides whether a consumer browser belongs on a case file at all (Can a Government Agency Allow Comet on Case Files?).
What do the vendors themselves say?
The vendor pages closest to this question sit on opposite sides of the model. The 1Password post on its OpenShell integration describes a sandbox where "the agent sees placeholders rather than real credentials", and a gateway that "replaces a placeholder with the real value only when the agent sends a request to an approved host" (1Password, OpenShell, 2026). The control is specific, and it is scoped to a development sandbox and an approved host; the page does not describe a rendered case screen or the values a case note carries.
Glean's agent governance page states that "Glean enforces permissions for every action an agent takes" (Glean, 2026). That sentence is about actions inside Glean's platform. It decides what an agent may do with the permissions it holds, and it does not state which fields of a case record the model reads before it proposes the action.
| Question | 1Password, per its documentation | Glean, per its documentation |
|---|---|---|
| What the model receives | Placeholders in the sandbox; the real value only on the way to an approved host | Not stated; the page describes permissions on actions |
| What the control decides | Which requests receive the real value | Which actions the agent may take |
| What a case file still needs | A policy for what the rendered case screen shows the model | A statement of what the model read before it acted |
Neither page describes a case management system, and neither is asked to. What they show is the split a buyer has to close: a control on what the model receives at the point a value is used, and a control on what the agent may do once it holds the page. A case file needs both. A buyer can put both questions to a vendor in one line: what does the model receive from a rendered screen, and who approves the action that follows it. Neither page answers the first for a case file.
Who approves the note an agent writes to a case record?
The approval question starts with what the agent platform requires. The 2025 AI Agent Index entry for Gemini Enterprise records approval requirements for decision types as "None" found and notes that users can pause or stop an agent (AI Agent Index, 2026). A pause stops a run in progress; it does not review the note the agent already drafted, and it names no one accountable for the text that enters the file.
Governance research treats approval as a design choice rather than a default. Statute rarely supplies the stop: of the 1,143 AI bills the National Conference of State Legislatures tracked in 2025, 9 required human review or oversight of an AI decision, and 1 was enacted (How Many AI Laws Require Human Review of AI Decisions?). OpenAI's whitepaper on agentic systems calls human approval "a standard way to limit egregious failures" and holds that "at least one human entity is accountable for every uncompensated direct harm" (Shavit et al., 2023). Applied to a case file, that means a person with authority over the record, not whoever happens to be using the browser.
The definition of the technology points the same way. MIT Sloan Management Review describes agentic AI as systems "capable of pursuing goals autonomously by making decisions, taking actions, and adapting to dynamic environments without constant human oversight" (MIT Sloan Management Review, 2025). A system built to work without constant oversight needs each consequential step to be a designed stop with a name attached, or the oversight never happens.
For a case file the consequential steps are specific: a note entered, a status changed, an address or payee updated, a service authorized, a case closed. Each is a record change a supervisor signs, and the signature is the evidence an agency produces when a decision is challenged (What Is Supervised Delegation?).
What record does the case system hold of an agent's run?
The case system's audit trail records that a user opened a case and changed a field. It does not record what the page showed the model, which is the part a family asks about when it wants to know how its information was used.
A vendor's claim about auditability shows where the record usually stops. Duck Creek's claims product sheet says decisions are "backed by full auditability, so automation is safe, explainable, and governed" (Duck Creek, 2026). The sheet is undated marketing copy that lists settlement, recovery and payment features; it describes a record of the decision and does not describe what the model read before making it.
Authentication is the other control an agency reaches for first. New York's Department of Financial Services writes that "Covered Entities should consider using authentication factors that can withstand AI-manipulated deepfakes" (New York State Department of Financial Services, 2024). That guidance is about proving who is present at a login. It says nothing about the page a model reads after the login succeeds, and a stronger login does not narrow the fields on the screen.
A record that answers this page's question joins three things: the screens the agent read and the values on them, the actions it took, and the name of the person who approved each action. The first item is the one the case system's own log leaves out.
What does a governed environment change?
The control class moves the question to where the page is built. Values chosen by policy are replaced with consistent tokens before any model reads the screen, so a case file renders as CLIENT_014 for the client and CASE_002 for the case number, while the client's name, date of birth and address in the note render as CLIENT_014, DOB_003 and ADDR_014. A note is never one token: only the personal information and account numbers inside free text are tokenized. The same token means the same person for the whole run, on the intake screen, the eligibility screen and the note the agent drafts. Real values resolve only at an approved destination, at the moment of an approved action, which for a case file is the letter the agency sends or the payment it releases rather than the model's context. A named person approves each note, status change and payment, and sees the real values at that point; the model that prepared the work does not.
That produces a record of what the model received. Every screen as tokens, every action and every approval is written to a record exported to the agency's own monitoring, so the record question does not depend on reconstructing a transcript later.
The scope is the rendered page. A control of this kind covers what the agent reads and does on a rendered page, and it does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP. For an agency, that scope is most of the work, because the case system is a web application and the agent's job is to read and act on its screens.
The limit the narrative creates stays visible. A token covers a value the policy knows: personal information is tokenized out of the box, and a name that appears only inside a free-text note is covered when the policy recognizes it. Where the policy does not recognize it, the supervisor's approval covers the rest: a supervisor reads the note before it enters the file, on the same screen, with the tokens resolved for the approver. Comparing the two halves of that design against a credential broker shows where each one stops (RedactSure vs 1Password: 2026 Comparison & Alternative).
What the record shows
The control this question needs sits at the render, not on the case record: values replaced with consistent tokens before any model reads the screen, a named person approving each note and status change, and a record of what the model received on every page. On that reading, a case management system is the hardest place to start, because a case file is a dossier on one person and its narrative is written in words no field rule can label. What the pages reviewed document is roles, permissions and pause controls, which decide who may open a file and what an agent may do. The narrative will be the longest item on that answer, and the one no settings page covers. A supervisor can test the gap in an afternoon: open one case in the agency's own system, name the fields and the sentences that would identify the family, and ask what the model receives for each and whose name appears in the record when the agent writes a note.
Methodology and limitations
This page rests on a county case management flyer, an undated claims product sheet, vendor documentation from 1Password and Glean, the MIT AI Agent Index, an OpenAI whitepaper, a benchmark of autonomous web agents, a regulator's industry letter and an industry analysis. Sources were read between October 16, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested for it. The products are described from their public documentation, and "not described in the pages reviewed" means the pages reviewed here and nothing broader. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a case file with free-text notes, not an organization. Determinations about whether a practice meets a legal or contractual requirement belong to counsel, assessors and the agency's own security and compliance officers. Nothing here replaces a pilot of one workflow on the agency's own screens.
Frequently asked questions
What can an AI agent see in a case management system?
Everything the case screen draws for the worker's role: the client's identity, the case number, eligibility findings, benefit amounts, court and medical records, the contact history and the narrative notes. The model receives the page as text, or as an image when the agent works from a screenshot, and the task decides what the agent uses, not what the page offers. Narrowing the page to the values the task needs takes a control placed before the model reads it.
Does an agent read case notes it was not asked to summarize?
Yes. A page renders as a whole, so the note sits beside the eligibility field whether or not the task mentions it. An agent working a case does not read a filtered view, and nothing in the case system labels the narrative as out of scope for the run. The reading follows from what the page shows, not from a decision the agent makes about relevance, which is why the note ends up in the context beside everything else.
Who should approve a note or a status change an agent makes?
A named person with authority over that case, approving the specific change rather than the agent's access in general. The approval should arrive before the note enters the file, with the real values visible to the approver, so the signature means someone read the text. A pause button on the agent is a different control: it stops a run, and it does not review what the run already wrote.
What record should an agency hold of an agent's run?
One record that joins the screens the agent read and the values on them, the actions it took, and the name of the person who approved each action. The case system's audit trail covers the second and names the user; it does not show what the page displayed to the model. The record should export to the agency's own monitoring, so an answer does not depend on a vendor's transcript.
Can a placeholder cover a name a worker types into a note?
Only when the case record already holds that name and the policy knows it. A token can replace the client and the household consistently across screens, because those identities are in the file. A note that introduces a neighbor, a teacher or a caller has no value in the record to match, so the sentence stays as written and the supervisor's read is the control.
What should an agency ask for in writing before it gives an agent a case screen?
Three answers: what the model receives from each rendered screen, in the agency's own applications rather than in a demonstration; who approves each note, status change and payment, by name; and what record the agency gets of the screens, actions and approvals, in a form its monitoring can query. If the first question has no written answer, the control has not been described. Test one case before signing.
How RedactSure Keeps a Case Narrative Out of the Model's Context
A role permission decides who may open a case file; it does not decide what the note field shows the model. The CWS-CARES flyer says "The screener narrative will be available for easy access throughout Intake".
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the model received the client's name, date of birth, address, case number and the worker's note with every name in it. Inside, those fields render as CLIENT_014, DOB_002, ADDR_003 and CASE_007, the note the agent drafts is written on the tokens, and a supervisor approves it with the real values in front of them. The record lists the screen, the note and the approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A case note carries names no field rule covers, and the record behind it belongs to one family. Bring one case task and see, with test values, what the model reads, who approves the note and what the record holds. Book a demo