Comparison · By Chris Sowa · Published
Last updated
What Is the Difference Between RedactSure and Anjuna for AI Agent Data Protection?
Anjuna protects data in use from the host, cloud provider and insiders through hardware enclaves, while the model inside still works on decrypted data; RedactSure tokenizes the screen a browser-based agent reads and holds each consequential action for a named person. Ask what the model inside the enclave receives, and treat enclaves as infrastructure underneath screen-level control.
Anjuna protects data in use from the host, cloud provider and insiders through hardware enclaves, while the model inside still works on decrypted data; RedactSure tokenizes the screen a browser-based agent reads and holds each consequential action for a named person. Ask what the model inside the enclave receives, and treat enclaves as infrastructure underneath screen-level control. The two controls are often confused because both are described as protecting data in use. Confidential computing answers who can see the machine's memory: not the hypervisor, not the cloud operator, not a root administrator. It does not change what the application inside the enclave processes, and for an AI agent that application is a model reading records. An enclave keeps data from the operator; it does not keep data from the model running inside it. RedactSure uses hardware enclaves too, for its own vault, and adds the control an enclave cannot supply: render-layer tokenization, so the model inside reads tokens. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Key findings
- Anjuna's Seaglass is a "Universal Confidential Computing Platform to run any app in any cloud," running applications in a hardware trusted execution environment "without requiring any code changes" and leaving what the model inside reads unchanged (Anjuna, 2026).
- Anjuna states that data in use is "inaccessible to the host OS, hypervisor, cloud provider, or any insider threat," a list that does not include the model (Anjuna, 2026).
- Anjuna's white paper on AI workloads says "only the enclave can decrypt the sensitive client data and perform its inference within the enclave," so the model inside works on decrypted data (Anjuna, 2023).
- Anjuna Overwatch, launched June 22, 2026, checks agent tool calls against a policy manifest and redacts sensitive data in tool results before they reach the model; Anjuna is recruiting regulated enterprises for an early feedback phase (Anjuna, 2026).
- OWASP lists sensitive information disclosure as a top risk for LLM applications, covering personal and confidential data that reach or leave a model (OWASP, 2025).
- Research on training data extraction showed that models can reproduce text they were exposed to (Carlini et al., 2021).
What does Anjuna's documentation say its products cover?
Anjuna sells three products. Seaglass is a "Universal Confidential Computing Platform to run any app in any cloud"; Northstar is an "AI Data Fusion Clean Room"; and Overwatch provides "Agentic AI governance and security" (Anjuna, 2026; vendor documentation, accessed October 16, 2026). Seaglass runs an application inside a hardware trusted execution environment "without requiring any code changes," with the model inside reading as before (Anjuna, 2026). The documentation covers AWS Nitro, AMD SEV, Kubernetes on SEV and Intel SGX, and SEV workloads can run inside Azure or Google Cloud confidential virtual machines (Anjuna docs, 2026).
The core guarantee is isolation. Anjuna states that data in use is encrypted and isolated, "inaccessible to the host OS, hypervisor, cloud provider, or any insider threat," while the model inside reads it decrypted (Anjuna, 2026). For an organization running an inference service or a data pipeline in a public cloud, that removes the cloud operator and the root administrator from the set of parties who can read memory. It is a control on the operator, not on the model, and it is the reason RedactSure runs its own vault in hardware enclaves.
The pages reviewed do not state several things a buyer evaluating browser-based agents will ask about. They do not describe tokenization or consistent replacement of values. They do not describe a person approving an individual agent action before it executes. They do not mention browsers, rendered screens or agents that operate applications through a web interface. How Overwatch connects to agent frameworks is not described. Other Anjuna documentation may cover these points; this page describes the pages reviewed.
What the pages do state places Anjuna at the infrastructure layer: the machine, its memory and who can see into it. That layer sits underneath whatever runs on it, including an AI agent and its model. The distinction between protecting the machine and protecting what the model reads is the subject of whether a confidential VM keeps data away from the AI, and the choice among those layers is set out in secure VM, confidential VM or render layer.
What happens to a sensitive value inside an enclave?
Take a single record: a patient account screen with a name, a date of birth, a member identifier and an open balance. An agent has been asked to reconcile the balance against a payer remittance.
In the design Anjuna's documentation describes, the agent and its model run inside an enclave. The host cannot read the record, the cloud provider cannot read it, and Anjuna's white paper adds that "even a sysadmin with root access to the inference service can't access the data," though the model inside can (Anjuna, 2023). The same paper states the mechanism: "Only the enclave can decrypt the sensitive client data and perform its inference within the enclave." Inside the enclave, the record is decrypted and the model reads the name, the date of birth and the member identifier as they are.
That sentence is the crux of this comparison. Confidential computing removes the operator from the set of parties who can see a patient's name; it does not remove the model. If the model is steered by a prompt injection, it is steered while holding the real values. Indirect prompt injection arrives through content the agent reads during legitimate work (Greshake et al., 2023), and the enclave cannot tell an injected instruction from a legitimate one because both are data the application is entitled to process. Research on training data extraction showed that models can reproduce text they were exposed to (Carlini et al., 2021), which is another reason to care what the model receives.
In RedactSure's design, the agent opens the patient account screen inside a governed environment. Before any model reads the screen, the name, date of birth and member identifier become consistent tokens such as PATIENT_001 and MEMBER_001. The balance and the remittance amount stay in clear because the reconciliation runs on them. The real values stay in RedactSure's vault, which runs in hardware-encrypted enclaves under keys the customer holds. If the task requires writing an identifier into a destination field, the real value resolves only at that approved destination, at the moment a named person approves the action.
The two controls stack. An enclave protects the vault and the inference service from their hosts. Tokenization protects the record from the model. What a successful injection collects from a model that reads only tokens is examined in what prompt injection gets from a token-only agent.
What does Overwatch add for AI agents, and where does it overlap with RedactSure?
Anjuna launched Overwatch on June 22, 2026, describing "context-aware policies that control tool use, and data access," running inside an enclave across cloud, on-premises and air-gapped environments for agents that act through tool calls (Anjuna, 2026). The product page says Overwatch grants "every agent... only the access explicitly allowed in its policy manifest," checks tool calls and MCP access at runtime, and maps actions to frameworks such as NIST 800-53 and PCI DSS "for instant reporting to security teams," all of it at the tool boundary (Anjuna, 2026).
Overwatch also adds a value-level control, and the overlap with RedactSure is real. It inspects outputs and tool results for personal data and secrets, and "detected sensitive data is redacted in real time" before results reach the model, for tool results only (Anjuna, 2026). That is the same direction as RedactSure's design: reduce what the model receives. Research supports the direction. Bhagwatkar and colleagues reported near-zero attack success on four agent benchmarks when a firewall stripped unneeded data from tool inputs and another cleaned tool outputs (Bhagwatkar et al., 2026).
The overlap has edges. Overwatch's controls act on tool calls and tool results; the pages reviewed do not mention browsers or screens, so an agent working a payer portal through its web interface is not addressed. Overwatch redacts; the pages reviewed do not describe consistent tokens, which matter when a task has to tell two patients apart or carry an identifier to a destination. The supervisor itself "sees every LLM message and tool call," which is why Anjuna runs it in an enclave. Anjuna's chief executive frames the design as protecting "the governance layer itself" and notes that a security component "can itself become part of the attack surface" (Anjuna, 2026). Overwatch is in an early feedback phase, and its capabilities may change.
For agents that work through APIs and MCP inside an Anjuna deployment, Overwatch is a credible control to evaluate. For agents that work applications through the browser, the screen is where the values arrive, and that is where RedactSure applies.
How do Anjuna and RedactSure compare side by side?
The table records what each side's documentation states. For Anjuna, that is the homepage, Seaglass and Overwatch pages, SEV documentation, white paper, blog posts and launch release, accessed October 16, 2026 (Anjuna, 2026). For RedactSure, it is the current published design.
| Dimension | Anjuna, per its documentation | RedactSure, per its published design |
|---|---|---|
| Question it answers | Who can see data in use on the machine? | What may the model see, and who approves what it does? |
| Hardware enclaves | Core product (Seaglass) across AWS Nitro, AMD SEV and Intel SGX | Used for RedactSure's vault, with customer-held keys |
| What the model inside reads | Decrypted data, per Anjuna's white paper | Tokens; real values stay in the vault |
| Agent value controls | Overwatch redacts sensitive data in tool results (early feedback phase) | Consistent tokens on every rendered screen; real values resolve only at approved destinations at the moment of an approved action |
| Tokenization | Not described in the pages reviewed | Identifiers chosen by policy replaced with consistent tokens before any model reads the screen |
| Browser and screen agents | Not addressed in the pages reviewed | The design center; the agent works applications as rendered, under existing user permissions |
| Human approval | Not described in the pages reviewed; Overwatch enforces a policy manifest | Supervised Delegation: a named person confirms policy before the run and approves every payment, submission and record change |
| Record | Actions mapped to NIST 800-53 and PCI DSS for reporting | AI Control Record: every screen as tokens, every action, every approval with a name, exported to the customer's SIEM |
| Integration and model | Seaglass needs no code changes; Overwatch integration not described; model relationship not stated | No per-application integration; model agnostic |
Cells that read "not described" or "not addressed" describe the pages reviewed, not the products' full capability, and a buyer should confirm each one with Anjuna. Anjuna's isolation of data in use acts at the infrastructure layer and stops at the model, and RedactSure does not claim to be a confidential computing platform. The RedactSure column describes a design in pilot.
Who approves an agent's action, and what does the record hold?
Overwatch enforces a policy manifest at runtime, for classes of action set in advance, and reports actions against compliance frameworks (Anjuna, 2026). The pages reviewed do not describe a person approving an individual action before it executes. Anjuna's chief executive identifies the harder question as whether "the context, sequence and intent of the action should be trusted" (Anjuna, 2026). That is a fair statement of the problem, and a policy manifest answers it in advance, for classes of action.
RedactSure answers it in the moment, with a person. Under Supervised Delegation, a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every payment, submission and record change before a real value resolves into the destination. The agent proposed that action while reading tokens.
The reason to hold actions outside the model is that model-internal defenses have gaps. OWASP describes prompt injection as a risk that can cause a model to take unintended actions (OWASP, 2025). MIT Technology Review reported in October 2026 that model refusal is treated as a primary safety mechanism and is far from foolproof (MIT Technology Review, 2026). Microsoft's AI Red Team taxonomy of agent failure modes includes failures that occur during execution even when configuration was sound (Microsoft, 2025). An enclave does not change any of these, because the failure happens inside the application the enclave protects.
The record follows the same split. Overwatch's mapping of actions to NIST 800-53 and PCI DSS serves compliance reporting. The AI Control Record captures every screen the agent saw as tokens, every action and every approval with a name, and exports to the customer's own SIEM. Because the screens are stored as tokens, the record is not a second copy of the identifiers. The two records answer different audit questions, a distinction drawn in The Two Gaps AI Agents Opened in Your Security Stack.
Where does RedactSure sit?
For agents that work applications through the browser, RedactSure sits at the screen, between the rendered application and the model. Inside a governed environment deployed into the customer's cloud, on hardware-encrypted enclaves with keys the customer holds, identifiers chosen by policy are replaced with consistent tokens before any model reads the screen. The model receives the task's fields with identifiers as tokens. Real values resolve only at approved destinations at the moment of an approved action, and a named person approves every payment, submission and record change. The environment is model agnostic, needs no per-application integration and leaves user permissions as they are. Deployments are in pilot. Confidential computing such as Anjuna's fits underneath as infrastructure protection for inference services and pipelines, the same reason RedactSure runs its vault in enclaves.
Everyone else controls where data can go. RedactSure controls what the AI can see.
Methodology and limitations
This page rests on Anjuna's homepage, Seaglass and Overwatch pages, SEV documentation, AI white paper, blog posts and Overwatch launch release, accessed October 16, 2026 (vendor documentation); OWASP's Top 10 for LLM Applications 2025 (standard); peer-reviewed and preprint research on indirect prompt injection, training data extraction and agent firewalls; Microsoft's AI Red Team and MIT Technology Review (industry analysis and press); and RedactSure's published design. Sources were read as of October 16, 2026.
No hands-on testing of Anjuna or any other named product was performed. The AI white paper is dated 2023; Anjuna's current pages do not restate the mechanism, and this page relies on the white paper's description. Overwatch is in an early feedback phase, and its capabilities may change. "Not described" refers only to the pages reviewed; other Anjuna documentation may describe the capability. Northstar and enclave performance were outside scope. Vendor features change, and the page carries its date. RedactSure statements describe the current design, with deployments in pilot. No specific organization is described, and the patient account example is an illustration.
Whether either product, or both together, meets an organization's obligations is a determination for its counsel, its assessors, and its own security and compliance officers. A buyer should confirm each "not stated" cell directly with Anjuna and request a demonstration of RedactSure's tokenized screen on the buyer's own task before relying on any row of the comparison.
What the record shows
Anjuna protects data in use from everyone outside the enclave, not from the model inside it, and Overwatch begins to govern what agents do with tools. Anjuna's own white paper is clear that inference happens on decrypted data inside the enclave, so the model reads what it is given. For agents that read screens of patient, policyholder and vendor records, the protection that matters changes what the model is given and holds the action for a person. The test is to name one agent and one task and ask each vendor to show what the model inside the enclave receives on the first screen of that task.
Frequently asked questions
Does confidential computing hide data from the AI model?
No. It hides data in use from the host, the hypervisor, the cloud provider and administrators. Anjuna's white paper states that the enclave decrypts the data and performs inference inside it, so the model works on the real values. Keeping identifiers from the model takes a separate control, such as tokenization at the render layer before the model reads the screen.
What is Anjuna Overwatch?
A supervisory layer for agents, launched June 22, 2026 and running in an enclave. Anjuna's pages say it enforces a policy manifest on tool use and MCP access, redacts sensitive data in tool results before they reach the model, and maps actions to compliance frameworks for reporting, for agents that act through tool calls. Anjuna is recruiting regulated enterprises for an early feedback phase.
Does RedactSure use enclaves?
Yes. RedactSure keeps real values in a vault that runs in hardware-encrypted enclaves under keys the customer holds. The enclave protects the vault from the host and the cloud operator. Tokenization at the render layer is what keeps those values away from the model, and real values resolve only at approved destinations when a named person approves the action.
Does Anjuna protect browser or computer-use agents?
The pages reviewed do not address agents that work through a browser or read rendered screens. Overwatch's controls are described as acting on tool calls and tool results. A buyer should confirm browser coverage with Anjuna. RedactSure's design center is the agent that works an application through its screen, with no per-application integration and no change to user permissions.
Does Anjuna require human approval of agent actions?
The pages reviewed do not describe a person approving an individual action before it executes. Overwatch enforces a policy manifest at runtime and reports actions against frameworks such as NIST 800-53 and PCI DSS, with no per-action approver described. Under Supervised Delegation, RedactSure requires a named person to approve every payment, submission and record change while the run is in progress.
Can an organization use Anjuna and RedactSure together?
Yes, the designs work at different layers. Anjuna protects infrastructure, inference services and pipelines from their hosts. RedactSure governs what browser-based agents see and who approves what they do, and it already relies on hardware enclaves for its own vault. A joint design can run confidential computing underneath and screen-level control on top.
Related reading
Does a Confidential VM Keep Data Away From the AI? · Secure VM, Confidential VM or Render-Layer Controls? · Does an AI Agent Need Its Own Virtual Machine? · What Does Prompt Injection Get From a Token-Only Agent? · What Is Render-Layer Tokenization? · What Is AI Agent Data Minimization? · On the RedactSure blog: The Two Gaps AI Agents Opened in Your Security Stack
Sources
Peer-reviewed research and preprints
- Greshake, Kai, et al., "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," arXiv:2302.12173, 2023 (preprint; also AISec 2023). https://arxiv.org/abs/2302.12173
- Carlini, Nicholas, et al., "Extracting Training Data from Large Language Models," USENIX Security 2021 (peer-reviewed). https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting
- Bhagwatkar, Kasa, et al., "Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?," arXiv:2510.05244, v2 March 2026 (preprint). https://arxiv.org/abs/2510.05244
Vendor documentation
- Anjuna, homepage (accessed October 16, 2026; vendor documentation). https://www.anjuna.io/
- Anjuna, "Seaglass" (accessed October 16, 2026; vendor documentation). https://www.anjuna.io/product/seaglass
- Anjuna, SEV documentation (accessed October 16, 2026; vendor documentation). https://docs.anjuna.io/latest/sev/latest/index.html
- Anjuna, "Confidential Computing: The Critical Enabler for AI-First CIOs in 2026" (April 6, 2026; vendor blog). https://www.anjuna.io/blog/confidential-computing-critical-enabler-ai-first-cios-2026
- Anjuna, "Confidential Computing for AI and Machine Learning Workloads" (2023; vendor white paper). https://info.anjuna.io/rs/606-SWH-978/images/white-paper-confidential-computing-for-ai-and-machine-learning-workloads.pdf
- Anjuna, "Overwatch" (accessed October 16, 2026; vendor documentation). https://www.anjuna.io/product/overwatch
- Anjuna, "Anjuna Security Launches Industry's First Trusted Control Plane for Autonomous AI" (June 22, 2026; vendor press release). https://www.anjuna.io/press/anjuna-overwatch-trusted-control-plane-autonomous-ai
- Anjuna, "Agent Security Is Moving Into Silicon. Anjuna Is Already There." (October 1, 2026; vendor blog). https://www.anjuna.io/blog/agent-security-is-moving-into-silicon
Regulation, standards and official guidance
- OWASP, "LLM01:2025 Prompt Injection" (2025; standard). https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- OWASP, "LLM02:2025 Sensitive Information Disclosure" (2025; standard). https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/
Industry analysis and press
- Microsoft AI Red Team, "Taxonomy of Failure Modes in Agentic AI Systems" (April 2025; whitepaper). https://www.microsoft.com/en-us/security/blog/2025/04/24/new-whitepaper-outlines-the-taxonomy-of-failure-modes-in-ai-agents/
- Holland Michel, Arthur, "We're putting too much faith in AI's ability to say no," MIT Technology Review (October 9, 2026; press). https://www.technologyreview.com/2026/10/09/1145728/we-are-putting-too-much-faith-in-ai-to-say-no/
RedactSure documents
- RedactSure Research, "What Is Render-Layer Tokenization?" (2026). https://redactsure.com/research/what-is-render-layer-tokenization/
- RedactSure Research, "Does a Confidential VM Keep Data Away From the AI?", "Secure VM, Confidential VM or Render-Layer Controls?", "What Does Prompt Injection Get From a Token-Only Agent?", "What Is Supervised Delegation?" and "What Is an AI Control Record?" (2026). https://redactsure.com/research/does-a-confidential-vm-keep-data-away-from-the-ai/ ; https://redactsure.com/research/secure-vm-confidential-vm-or-render-layer/ ; https://redactsure.com/research/prompt-injection-agent-sees-only-tokens/ ; https://redactsure.com/research/what-is-supervised-delegation/ ; https://redactsure.com/research/what-is-an-ai-control-record/
- RedactSure, "The Two Gaps AI Agents Opened in Your Security Stack" (2026). https://redactsure.com/blog/two-gaps-ai-agents-opened-in-your-security-stack/
- Product behavior described on this page reflects RedactSure's current design. Anjuna, Seaglass, Northstar and Overwatch are trademarks of Anjuna Security, Inc.; AWS Nitro, AMD SEV and Intel SGX are trademarks of their respective owners; named to identify the products.
Does a Confidential VM Keep Sensitive Data Away From the AI? No. It Keeps the Data Away From the Provider
Examine confidential computing and AI agent security, distinguishing provider isolation from tokenization of the PII a model can read.
Secure VM, Confidential VM, or Render Layer: Which One Decides What the AI Sees?
Compare virtual-machine boundaries and render-layer tokenization for AI agent security, focusing on which controls limit visible PII.
Does an AI Agent Need Its Own Virtual Machine? What the Isolated Environment Governs, and the One Thing It Cannot
Examine what a dedicated virtual machine adds to AI agent security and why tokenization is a separate control for visible sensitive PII.
What Does a Prompt-Injection Attack Get From an Agent That Sees Only Tokens? Walking the Attack That Succeeds and Collects Nothing
Follow a prompt-injection scenario to examine AI agent security, PII exposure and the limits of tokenization when an attack succeeds.
What Is Render-Layer Tokenization? The Control at the Layer Where the Agent Actually Reads
Learn how render-layer tokenization replaces PII before an AI agent reads a browser screen while preserving useful workflow context.
What Is AI Agent Data Minimization?
Review AI Agent Data Minimization, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.
The Two Gaps AI Agents Opened in Your Security Stack
Explore AI agent security through two questions: which PII reaches the model, and who approves consequential billing and claims actions.
What Is Supervised Delegation? Who Answers for an AI Agent, and What the Record Shows
Explore supervised delegation for AI agents in billing and claims, with named responsibility, tokenization policies and human approvals.
What Is an AI Control Record? The Runtime System of Record for Sensitive AI Work
Explore an AI agent control record for billing and claims, linking permissions, tokenization decisions, approvals and audit evidence.
Book an AI Agent Security Review →
Bring your hardest questions.
Bring one sensitive workflow and the decisions your team needs to keep in its hands.
Book a demoAbout the author
Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.