Skip to content
redactsure
Book a demo

Explore.

Comparison · By Chris Sowa · Published
Last updated

What Is the Difference Between RedactSure and Arcade for AI Agent Actions and Data Protection?

Arcade governs what agents do through APIs and MCP tools and keeps credentials out of the model; RedactSure governs agents working applications through the browser, tokenizing the screen and holding each consequential action for a named person. For each workflow, check whether the application offers an API or only a screen, and what the model reads there.

An agent connects to separate tool blocks beside another agent viewing a browser through layered screen boundaries.

Arcade governs what agents do through APIs and MCP tools and keeps credentials out of the model; RedactSure governs agents working applications through the browser, tokenizing the screen and holding each consequential action for a named person. For each workflow, check whether the application offers an API or only a screen, and what the model reads there. Arcade is an actions runtime for API and MCP tool calls: it brokers user authorization at the moment of action. When a system offers a documented API or an MCP server, that design is sound: the agent calls a tool, the user authorizes the scope, and the token never reaches the model. Much of regulated work happens in applications that offer no such interface, such as carrier claims systems, clearinghouse and payer portals, state licensing sites and legacy vendor screens. There the only interface is the rendered page, and an agent working it reads every value on it. The control that applies there is render-layer tokenization with a named person on the action, and it is the control a team evaluating browser-based agents should look for first. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • Arcade's product page lists "8,000+ agent-optimized tools across 80+ toolkits," with Arcade-hosted, custom and third-party MCP servers federated "into a single endpoint," every tool reached through an API (Arcade, 2026).
  • Arcade keeps credentials out of the model: it states that the token is never handed to the LLM or the MCP client, and that tokens sit in an encrypted, per-user vault the model never touches, while the data a tool returns still reaches the model unless a customer hook changes it (Arcade, 2026; Arcade, 2026).
  • Arcade masks data values only through customer-built hooks: a post-execution hook can redact or replace output before it reaches the model, and the customer implements and hosts the webhook; built-in PII detection is not described in the pages reviewed (Arcade docs, 2026).
  • User consent happens at OAuth authorization, and the pages reviewed describe no per-action human approval and no browser or computer-use capability (Arcade docs, 2026).
  • OWASP lists excessive agency, damaging actions taken on manipulated or unexpected model output, among its 2025 top risks for LLM applications (OWASP, 2025).
  • Planted instructions in content an LLM application reads can redirect it (Greshake et al., 2023), and a 2026 study found that stripping unneeded data at the tool boundary brought attack success near zero on four agent benchmarks (Bhagwatkar et al., 2026).

What does Arcade's documentation say the product covers?

Arcade's homepage leads with "Govern every action for every AI agent" and describes the product as "the actions runtime between your agents and every system they reach," reached through an API or MCP server (Arcade, 2026; vendor documentation, accessed October 16, 2026). The product page says Arcade federates Arcade-hosted, custom and third-party MCP servers "into a single endpoint," offers "8,000+ agent-optimized tools across 80+ toolkits," and translates "natural language intent to precise API calls across Salesforce, ServiceNow, Workday" and other systems, which presumes an API on the other side (Arcade, 2026). The same page describes evaluations that test tool-call accuracy before a toolkit ships. Arcade's documentation describes "an authorization system that handles OAuth 2.0, API keys, and user tokens" for tool calls (Arcade docs, 2026).

Arcade raised a $60 million Series A in June 2026 and describes itself as "the secure action layer for production AI agents" that act through APIs (Fenwick, 2026). It reports SOC 2 Type 2 (Arcade, 2025).

Arcade says it authorizes "at the moment of action," enforcing "at the intersection of what the agent is allowed to do and what the user is allowed to do," a check on the call rather than on what the model reads (Arcade, 2026). A tool call proceeds only when both the agent's grant and the user's own rights allow it.

The pages reviewed do not state several things a buyer evaluating browser-based agents will ask about. They describe no browser or computer-use capability, no built-in detection of personal data and no consistent tokenization of values. They do not describe a person approving an individual action after OAuth consent. Every capability described assumes the system exposes an API or an MCP server. Other Arcade documentation may cover these points.

What the pages do state places Arcade at the action layer for API and MCP agents: which tools an agent can call, under whose authority, with credentials kept out of the model. The choice between that path and the screen is the subject of whether an AI agent should work through the screen or through APIs and MCP, and the reach that tools give an agent is covered in what AI agent tool access is.

What happens to a sensitive value in each design?

Take a single record: a vendor master record with the vendor's name, tax identifier, bank account number and remittance address. An agent has been asked to confirm that an incoming invoice matches the vendor on file before a payment run.

In the design Arcade's pages describe, the agent reaches the ERP through a toolkit. The OAuth token that opens the ERP stays in the runtime: "The LLM should never touch a credential at all," and "credentials live in the runtime, not the reasoning loop," while the record the tool returns goes to the model (Arcade, 2026). Tokens are held in a per-user encrypted vault, encrypted at rest through a key management service, and self-hosted deployments keep the vault in the customer's environment; the vault guards credentials, not the data they unlock (Arcade, 2026). That part of the design is strong.

The record's values follow a different path: the model receives what the tool returns. Arcade's Contextual Access hooks run at three points: an access hook that controls which tools an agent sees, a pre-execution hook that allows, modifies or denies a call, and a post-execution hook that can redact or replace output "before it reaches the LLM," each one code the customer writes (Arcade, 2026). The customer implements the webhook contract and hosts the server; the default timeout is five seconds, and hooks can fail open or closed (Arcade docs, 2026). Whether the bank account number reaches the model depends on a hook the customer writes and keeps running. Move the same record into a supplier portal with no API, and the pages reviewed describe no way for Arcade to reach it.

In RedactSure's design, the agent opens the portal or the ERP screen inside a governed environment. Before any model reads the screen, the vendor's tax identifier and bank account number become consistent tokens such as VENDOR_001 and ACCT_001. The invoice amount and remittance date stay in clear because the match runs on them. If the task requires writing the account number into a payment field, the real value resolves only at that approved destination, at the moment a named person approves the action.

OWASP names sensitive information disclosure as a top LLM risk (OWASP, 2025), and indirect prompt injection research shows that content a model reads can carry instructions that redirect it (Greshake et al., 2023). Keeping the credential from the model closes one path. Keeping the identifiers from the model closes the other, the gap examined in whether a credential vault can protect what an AI agent reads.

How do Arcade and RedactSure compare side by side?

The table records what each side's documentation states. For Arcade, that is the homepage, product page, documentation and blog posts accessed on October 16, 2026 (Arcade, 2026). For RedactSure, it is the current published design.

Dimension Arcade, per its documentation RedactSure, per its published design
What it governs Tool calls through APIs and MCP servers The rendered screen an agent reads inside a governed environment, and the actions the agent takes there
Applications covered Systems with a toolkit, API or MCP server Any application with a web interface, including ones with no API
Browser and computer use The pages reviewed do not describe it The design center; the agent works the application as rendered, under existing user permissions
Position relative to the model Between the agent and the systems it calls; position relative to a rendered screen not stated Between the rendered screen and the model; tokenization happens before any model reads the screen
Credentials Per-user encrypted vault; never handed to the LLM or the MCP client Vaulted in hardware-encrypted enclaves with customer-held keys; never shown to the model
Data values the model reads Redacted or replaced only through customer-built post-execution hooks; built-in PII detection not described Identifiers chosen by policy replaced with consistent tokens; real values resolve only at approved destinations at the moment of an approved action
Human approval User consent at OAuth authorization; per-action approval not described in the pages reviewed Supervised Delegation: a named person confirms policy before the run and approves every payment, submission and record change
Record One audit record per action, streamed to the customer's SIEM through OpenTelemetry AI Control Record: every screen as tokens, every action, every approval with a name, exported to the customer's SIEM
Integration and model A toolkit or MCP server per system; customer-hosted hooks for value controls; model relationship not stated No per-application integration; model agnostic, so models swap without moving the controls

Cells that read "not described" or "not stated" describe the pages reviewed, not the product's full capability, and a buyer should confirm each one with Arcade. Arcade's credential isolation and per-action audit are documented for the API path and no other in the pages reviewed, and RedactSure does not claim to be a tool catalog or an MCP gateway. The RedactSure column describes a design in pilot.

Where does the integration work fall, a toolkit per system or the rendered screen?

In Arcade's design, the work is a toolkit per system. The catalog covers many SaaS applications that expose an API, and custom tools are built with Arcade's framework (Arcade, 2026). Controls on the data a tool returns require the customer to build and host webhooks (Arcade docs, 2026). With good APIs, that is efficient.

The cost appears where no API exists. A claims portal, a clearinghouse screen or a legacy vendor application usually offers a page and a login, and an agent working it has to read the page. Arcade's pages reviewed describe no way to do that.

In RedactSure's design, the integration is the environment: the agent operates applications through their web interfaces inside a workspace in the customer's cloud, and tokenization happens on the rendered page. Adding a legacy claims screen or a payer portal costs a field-by-field policy that the Planner sets and a named person confirms, not a connector.

Research points to minimization at a boundary outside the model as the control that holds up. Bhagwatkar and colleagues tested a Tool-Input Firewall that strips data a tool call does not need, alongside a Tool-Output Firewall that cleans returned content, and reported near-zero attack success with little loss of utility across four agent benchmarks (Bhagwatkar et al., 2026). Arcade's pre-execution and post-execution hooks sit at the same tool boundary the study examined, and what they strip depends on what the customer writes into them. RedactSure applies the same principle at the screen by default, under a policy confirmed before the run.

The two integration models do not compete for the same systems. API-ready systems can go through an actions runtime, and systems that offer only a screen can run inside a governed environment.

How do authorization, approval and the record differ?

Arcade's human checkpoint is authorization, granted once per scope rather than per action. The user visits a URL and approves the OAuth scope (Arcade docs, 2026); after that, actions within the scope proceed, subject to hooks and policy. Arcade streams one audit record per action on the API path to the customer's SIEM through OpenTelemetry, recording the agent, the user, the system, the scope and the policy decision (Arcade, 2026). Its published prompt injection examples are enforced through customer webhooks (Arcade, 2026). Per-action approval by a person is not described in the pages reviewed.

Authorization is given once for a class of actions: this agent may write to this system on this user's behalf. Approval is given in the moment for one action: this payment, this amount, this payee. OWASP describes prompt injection as a risk that can cause a model to take unintended actions (OWASP, 2025), and an unintended action inside a valid scope is still inside the scope. MIT Technology Review reported in October 2026 that model refusal is treated as a primary safety mechanism and is far from foolproof (MIT Technology Review, 2026).

RedactSure separates authorization from approval. Under Supervised Delegation, a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every payment, submission and record change, on the record. A valid scope does not by itself move money or change a record. If an injection succeeds against a RedactSure agent, it collects tokens, and the consequential action still stops for a named person.

The record follows the same split. Arcade's per-action record answers which agent called which tool, for which user, under which policy decision, and nothing about a screen the agent read. The AI Control Record captures every screen the agent saw as tokens, every action and every approval with a name, and exports to the customer's own SIEM. Because the screens are stored as tokens, the record is not a second copy of the identifiers. The two records answer different audit questions, a distinction drawn in The Two Gaps AI Agents Opened in Your Security Stack.

Where does RedactSure sit?

For agents that work applications through the browser, RedactSure sits at the screen, between the rendered application and the model. Inside a governed environment deployed into the customer's cloud, on hardware-encrypted enclaves with keys the customer holds, identifiers chosen by policy are replaced with consistent tokens before any model reads the screen. The model receives the task's fields with identifiers as tokens. Real values resolve only at approved destinations at the moment of an approved action, and a named person approves every payment, submission and record change. The environment is model agnostic, needs no per-application integration and leaves user permissions as they are. Deployments are in pilot. Arcade fits at the action layer for systems with good APIs and MCP servers, and an organization can run Arcade for API tool calls and RedactSure wherever an agent opens an application in a browser.

Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on Arcade's homepage, product page, documentation and blog posts, accessed October 16, 2026 (vendor documentation); a law firm announcement of Arcade's Series A; OWASP's Top 10 for LLM Applications 2025 (standard); preprint research on indirect prompt injection and agent firewalls; MIT Technology Review (press); and RedactSure's published design. Sources were read as of October 16, 2026.

No hands-on testing of Arcade or any other named product was performed. Arcade's homepage and product page describe its evaluations differently; this page uses the product page description. "Not stated" refers only to the pages reviewed; other Arcade documentation may describe the capability. Tool quality, catalog coverage and performance were outside scope. Vendor features change, and the page carries its date. RedactSure statements describe the current design, with deployments in pilot. No specific organization is described, and the vendor record example is an illustration.

Whether either product, or both together, meets an organization's obligations is a determination for its counsel, its assessors, and its own security and compliance officers. A buyer should confirm each "not stated" cell directly with Arcade and request a demonstration of RedactSure's tokenized screen on the buyer's own task before relying on any row of the comparison.

What the record shows

Arcade has built a careful answer for API-driven agents: credentials stay in the runtime, authorization happens at the moment of action, and every action leaves a record in the customer's SIEM, none of it reaching a browser. That answer depends on an API or an MCP server, and value protection depends on hooks the customer builds. Claims platforms, payer portals and legacy vendor screens offer a page instead, and an agent reads everything on it. The test is to name one agent and one task on a system with no API and ask each vendor to show what the model receives on the first screen and who approves the payment.

Frequently asked questions

Does Arcade keep credentials away from the model?

Yes, according to its documentation. Arcade states that the token is never handed to the LLM or the MCP client, and that tokens are stored in an encrypted per-user vault, encrypted at rest through a key management service; the data a tool returns still reaches the model unless a customer hook redacts it. Self-hosted deployments keep the vault in the customer's environment. RedactSure also keeps credentials where the model never sees them.

Does Arcade redact or tokenize data an agent reads?

Through customer-built post-execution hooks, which can redact or replace tool output before it reaches the model. The customer implements and hosts the webhook, with a default five-second timeout and a choice to fail open or closed. Built-in PII detection and consistent tokenization are not described in the pages reviewed. RedactSure tokenizes the rendered screen by policy before any model reads it.

Can Arcade govern agents that work through a browser?

The pages reviewed describe API-based integrations, toolkits and MCP servers, and no browser or computer-use capability; a buyer should confirm this with Arcade directly. RedactSure's design center is the agent that works an application through its rendered screen, including applications with no API, inside a governed environment with no per-application integration.

Does Arcade require human approval for each action?

User consent happens at OAuth authorization, when the user visits a URL and approves the scope. After that, actions within the scope proceed subject to hooks and policy. Per-action approval by a person is not described in the pages reviewed. Under Supervised Delegation, RedactSure requires a named person to approve every payment, submission and record change while the run is in progress.

Where is each product's record kept?

Arcade streams one record per API tool call to the customer's SIEM through OpenTelemetry, covering the agent, the user, the system, the scope and the policy decision. RedactSure's AI Control Record captures every screen as tokens, every action and every approval with a name, and also exports to the customer's own SIEM.

Can an organization use Arcade and RedactSure together?

Yes, the designs govern different interfaces. Arcade governs tool calls for systems that offer APIs and MCP servers, with credentials kept in its runtime. RedactSure governs agents that work applications through the browser, tokenizing the screen and holding consequential actions for a named person. Each workflow goes to the control that matches the interface its application offers.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.