Skip to content
redactsure
Book a demo

Explore.

Comparison · By Chris Sowa · Published
Last updated

What Is the Difference Between RedactSure and Akamai Workforce Protector (Formerly LayerX) for AI Agent Security?

Akamai Workforce Protector, formerly LayerX, governs what people and AI browsers type, paste, upload and visit; RedactSure governs what a sanctioned agent's model reads on the rendered page and who approves its actions. Ask each vendor to show what the model receives on a permitted screen full of identifiers and who approves the submission that follows.

Browser traffic controls appear beside a separate screen boundary and an action held at an approval button.

Akamai Workforce Protector, formerly LayerX, governs what people and AI browsers type, paste, upload and visit; RedactSure governs what a sanctioned agent's model reads on the rendered page and who approves its actions. Ask each vendor to show what the model receives on a permitted screen full of identifiers and who approves the submission that follows. The two products live in the same place, which makes the difference easy to miss. Both work in the browser, and both now address AI agents. Akamai describes Workforce Protector as an extension on the browsers an organization already runs that applies policy to the outbound path: the paste into a chatbot, the upload to an unapproved site, the agent heading to a sensitive domain (Akamai, 2026). A sanctioned agent assigned to a claims screen raises a different question. Once it is allowed onto the page, what does its model read, and who decides before it submits, pays or changes a record? That is the question render-layer tokenization was designed for. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • Akamai completed its acquisition of LayerX on July 2, 2026, and markets the product as "Akamai Workforce Protector (formerly LayerX)" (Akamai, 2026).
  • Workforce Protector installs "as an extension on the browsers your organization already runs" and can "warn, redact, block, or guide user actions based on context and risk," covering "text input, copy/paste, uploads, downloads, and data exchanges," all of them things a person or agent sends rather than what a model reads (Akamai, 2026).
  • For AI agents, the product page says Workforce Protector "detects agentic activity, distinguishes it from user activity, controls the AI side panel," and governs an autonomous agent "by the same policies as a person"; the pages reviewed describe no human approval of individual agent actions (Akamai, 2026).
  • LayerX's February 2026 launch for agentic browsers described letting administrators prevent AI agents from accessing sensitive websites and stop agents pasting certain data types, and nothing about what an agent reads on a permitted page (CIO Influence, 2026).
  • OWASP lists prompt injection as LLM01, the first entry in its Top 10 for LLM Applications 2025, and includes indirect injection through external content the model processes (OWASP, 2025).
  • A 2026 study found that a model-agnostic firewall which strips unneeded data before tool calls, paired with one that cleans tool outputs, brought attack success near zero on four agent benchmarks (Bhagwatkar et al., 2026).

What does Akamai's documentation say Workforce Protector covers?

Akamai announced its intent to acquire LayerX on May 14, 2026, for "approximately US$205 million," describing LayerX as a provider of "browser-based AI usage control and secure enterprise browser (SEB) technology," controls on what people and browsers send out (Akamai, 2026). The acquisition closed on July 2, 2026 (Akamai, 2026), and LayerX's site now redirects to the Akamai product page.

The product "installs as an extension on the browsers your organization already runs," across Chrome, Edge, Firefox and Safari on managed, unmanaged and personal devices, and deploys "without proxies, network redesign, or browser replacement," governing the outbound path on each (Akamai, 2026). Akamai positions it as supporting "the most popular browsers, unlike proprietary enterprise browsers," as an extension that acts on what leaves the browser (Akamai, 2026).

On data, the product page describes data loss prevention over "text input, copy/paste, uploads, downloads, and data exchanges," with actions to "warn, redact, block, or guide user actions based on context and risk," applied to what is sent rather than what a page shows (Akamai, 2026). The solution brief describes "governance for all AI usage, including prompts, responses, and data pastes in real time" for traffic the extension sees (Akamai, 2026). Akamai's materials say the product complements secure web gateway, CASB and endpoint DLP controls rather than replacing them, and describe centralized investigations and reporting designed to work with a SIEM (Akamai, 2026).

The pages reviewed do not describe tokenization, consistent replacement values or the detection method behind the redact action. They do not state whether governance of AI responses changes what an agent's model reads on a business application page, and they do not state log formats or retention. Each may be covered elsewhere in Akamai's documentation.

What happens to a sensitive value in each design?

Take a single record: a claim on a payer portal showing a member's name, date of birth, member ID and a billed amount. An agent has been asked to check the claim's status and submit a correction.

In the design Akamai's pages describe, the agent runs in a browser carrying the extension, possibly an AI browser such as ChatGPT Atlas or Comet. Policy can decide whether the agent may visit the portal at all; LayerX's agentic browser launch described letting administrators "prevent AI agents from accessing sensitive websites," not what an agent reads once admitted (CIO Influence, 2026). If the agent later tries to paste the member ID into an unsanctioned AI tool, data loss prevention can warn, redact or block the paste, after the model has read the value (Akamai, 2026). LayerX's earlier GenAI DLP page described barring users from pasting data into an AI tool, limiting paste to defined data types, and warning or blocking, each a control on the person's paste (LayerX, undated). Each control acts at the moment a value leaves. Once the agent is permitted on the portal, the pages reviewed describe nothing that changes what its model reads there.

In RedactSure's design, the agent works the portal inside a governed environment. Before any model reads the screen, the environment replaces the member's name, date of birth and member ID with consistent tokens such as PATIENT_001 and ACCT_001. The billed amount stays in clear because the correction runs on it. If the correction requires the real member ID in a form field, the value resolves only at that approved destination, at the moment a named person approves the submission. This is screen-level tokenization applied per task, and the principle behind it is AI agent data minimization.

The difference matters because of what a model does with what it reads. OWASP names sensitive information disclosure as a top LLM risk (OWASP, 2025), and indirect prompt injection research shows that content a model reads can carry instructions that redirect it (Greshake et al., 2023). An outbound control decides where a value may go after the model holds it. A render-layer control decides whether the model holds it at all. The two stack.

How do the two compare side by side?

The table records what each side's documentation states. For Workforce Protector, that is Akamai's product page and solution brief, its two acquisition press releases and LayerX's legacy GenAI DLP page, read on October 16, 2026 (Akamai, 2026). For RedactSure, it is the current published design.

Dimension Akamai Workforce Protector, per its documentation RedactSure, per its published design
What it is Browser extension for AI usage control, formerly LayerX Governed environment where supervised agents complete browser workflows
Where it runs Chrome, Edge, Firefox and Safari, on managed, unmanaged and personal devices The customer's cloud, on hardware-encrypted enclaves with keys the customer holds
Direction of control Outbound: text input, copy and paste, uploads, downloads, data exchanges and site access Inbound to the model: what the agent's model reads on each rendered screen
Treatment of a sensitive value Warn, redact, block or guide at the moment it leaves; tokenization and detection method not stated in the pages reviewed Consistent token per entity before any model reads the screen; real value resolves only at approved destinations
AI agents Detects agentic activity, distinguishes it from user activity, controls the AI side panel, applies the same policies as for a person; restricts sites Agents a named person connects to the environment; the model receives tokens; model agnostic
A permitted page full of identifiers A change to what the agent reads is not described in the pages reviewed The model reads tokens in place of identifiers
Human approval of agent actions Not described in the pages reviewed A named person approves every payment, submission and record change
Record Centralized investigations and reporting, designed to work with a SIEM; formats and retention not stated AI Control Record: every screen as tokens, every action, every approval with a name, exported to the customer's SIEM
Relationship to other controls Complements secure web gateway, CASB and endpoint DLP No per-application integration; user permissions unchanged

Cells that read "not stated" or "not described" describe the pages reviewed, not the product's full capability, and a buyer should confirm each one with Akamai or in a demonstration. The RedactSure column describes a design with deployments in pilot.

Who is being governed, a workforce's browsers or a sanctioned agent's run?

Workforce Protector governs a population. The product page says it "detects agentic activity, distinguishes it from user activity, controls the AI side panel," and that an autonomous agent "is governed by the same policies as a person" (Akamai, 2026); a policy written for a person does not describe what a model receives. LayerX's February 2026 launch named ChatGPT Atlas, Comet, Dia and Genspark among the agentic browsers it covered for outbound control (CIO Influence, 2026). The unit is every browser in the organization, including agents nobody sanctioned. The question is coverage: is any person or agent sending data where it should not go?

LayerX's researchers also disclosed a flaw in Claude in Chrome through which other extensions could issue it commands, a finding about extension permissions rather than about what a model reads (CSO Online, 2026). An agent in an employee's everyday browser shares that browser's extensions, the trade-off examined in should an AI agent run in the employee's own browser.

RedactSure governs a run. The unit is one agent doing one piece of work for one named person. The tethered agent works only inside the environment that person connected it to, on the applications that person chose. The question is exposure: on this screen, for this task, what should the model read?

Applying a person's policies to an agent is a reasonable default for the workforce, and it leaves a gap for sanctioned work. Gartner reported in May 2026 that applying uniform governance across AI agents will lead to enterprise AI agent failure, arguing that agents differ enough that one policy set does not fit all (Gartner, 2026). An agent can be steered by text hidden in a field: OWASP treats indirect injection through processed content as part of LLM01 (OWASP, 2025). Bhagwatkar and colleagues found that stripping data a tool call does not need, and cleaning what comes back, brought attack success close to zero on four agent benchmarks (Bhagwatkar et al., 2026). In a RedactSure run, an injection that succeeds collects tokens and remaining task context, and the consequential action still stops for a named person.

How do approval and the record differ?

Workforce Protector applies policy to agents as it does to people, on what they send: warn, redact, block or guide (Akamai, 2026). The pages reviewed do not describe a person approving an individual action an agent takes inside an approved application, such as submitting a form or changing a record.

In RedactSure's design, approval sits inside the run. Under Supervised Delegation, a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every consequential action on the record. The Planner sets which values are tokenized and what the agent may do on each screen; the named person confirms that policy before the run starts. There is no always-allow setting, and the agent never pays, submits or changes a record on its own authority.

The reason to hold actions outside the model is that model-internal defenses have gaps. MIT Technology Review reported in October 2026 that model refusal is treated as a primary safety mechanism and is far from foolproof, with vendors stacking layered defenses whose individual holes they hope will not line up (MIT Technology Review, 2026). The NIST AI Risk Management Framework places decisions taken while work is in progress under Manage (NIST, 2023).

The record follows the same split. In RedactSure's design, the AI Control Record captures every screen the agent saw as tokens, every action and every approval with a name, and exports to the customer's own SIEM. Workforce Protector's investigations and reporting, as Akamai describes them, serve the workforce view. The two records answer different audit questions, which is the pattern described in the two gaps AI agents opened in the security stack.

Where does RedactSure sit?

For browser-based agent work in sensitive applications, RedactSure sits at the screen, between the rendered application and the model. Inside a governed environment deployed into the customer's cloud, on hardware-encrypted enclaves with keys the customer holds, identifiers chosen by policy are replaced with consistent tokens before any model reads the screen. Real values resolve only at approved destinations at the moment of an approved action, and a named person approves every payment, submission and record change. The environment is model agnostic, needs no per-application integration and leaves user permissions as they are. Deployments are in pilot. Workforce Protector complements it as the browser control for the rest of the workforce, governing what people and unsanctioned AI browsers type, paste, upload and visit. One governs the agents the organization sanctions; the other governs the AI usage it has not.

Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on Akamai's Workforce Protector product page and solution brief, its May 14 and July 2, 2026 press releases, and LayerX's legacy GenAI DLP page, accessed October 16, 2026 (vendor documentation); press coverage from CIO Influence and CSO Online; OWASP's Top 10 for LLM Applications 2025 and the NIST AI Risk Management Framework (standards and guidance); preprint research on indirect prompt injection and agent firewalls; industry analysis from Gartner and MIT Technology Review; and RedactSure's published design.

No hands-on testing of Workforce Protector or any other named product was performed. Where the pages reviewed do not state a capability, the page says so; "not stated" and "not described" mean the pages reviewed, and other Akamai documentation may describe it. LayerX's legacy pages may be removed as the brand is retired. Vendor features change, and the page carries its date. RedactSure statements describe the current design, with deployments in pilot. No specific organization is described; the claim record is a type of work.

Whether either product, or both together, meets an organization's obligations is a determination for its counsel, its assessors, and its own security and compliance officers. A buyer should confirm each "not stated" cell directly with Akamai and request a demonstration of RedactSure's tokenized screen on the buyer's own task before relying on any row of the comparison.

What the record shows

Workforce Protector brings data loss prevention to the browsers people already use and extends it to AI browsers and agents: it can see agentic activity, keep agents off sensitive sites and stop them pasting restricted data, without describing what a model reads on a permitted page. Each of those controls acts on what leaves. An agent permitted onto a claims screen still reads what the screen renders unless the screen changes before the model reads it, and nothing in the pages reviewed describes that change or an approval step. For sanctioned agent work, that is RedactSure's job. The test is to name one agent and one task and ask each vendor to show what the model receives on the first screen and who approves the submission.

Frequently asked questions

Is LayerX part of Akamai now?

Yes. Akamai announced its intent to acquire LayerX on May 14, 2026, for approximately US$205 million, and completed the acquisition on July 2, 2026. The product is now marketed as Akamai Workforce Protector (formerly LayerX), and LayerX's site redirects to the Akamai product page. Some legacy pages remain for now.

Does Workforce Protector control what an AI agent reads on a page?

The pages reviewed describe controls on what agents and people type, paste, upload, download and visit, and on which sites agents may reach. They do not describe changing what an agent's model reads on a rendered page once the agent is permitted there. RedactSure replaces identifiers with consistent tokens on the screen before any model reads it.

Does Workforce Protector tokenize sensitive data?

The pages reviewed describe warning, redacting, blocking and guiding at the moment data leaves, across text input, copy and paste, uploads, downloads and data exchanges. They do not describe tokenization, consistent replacement values or the detection method. Other Akamai documentation may describe additional mechanisms, so a buyer should ask Akamai directly.

Can Workforce Protector and RedactSure be used together?

Yes, the designs govern different workers. Workforce Protector governs human and unsanctioned AI usage at the outbound path across the browsers employees already run, including on unmanaged devices. RedactSure governs what sanctioned agents see inside a governed environment and who approves what they do. An organization with both a workforce using AI tools and delegated agent work has two questions, and each product answers one.

Does Workforce Protector require human approval of agent actions?

Not in the pages reviewed. Akamai describes agents being governed by the same policies as a person, with warn, redact, block or guide actions, not a person approving an individual action. RedactSure requires a named person to approve every payment, submission and record change, and records each approval with that person's name in the AI Control Record, which exports to the customer's SIEM.

What does a prompt injection collect in each design?

Where an agent's model reads real values on a permitted page, a successful injection has whatever the agent read. In a RedactSure run, the model holds tokens such as PATIENT_001 and ACCT_001 in place of identifiers, so an injection collects tokens and remaining task context, and the consequential action still stops for a named person.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.